std.compress.xz: Avoid possible integer overflow in a few places

Closes ziglang#14500

Author: squeek502

lib/std/compress/xz.zig

@@ -118,7 +118,7 @@ pub fn Decompress(comptime ReaderType: type) type {
                 var hasher = std.compress.hashedReader(self.in_reader, Crc32.init());
                 const hashed_reader = hasher.reader();
 
-                const backward_size = (try hashed_reader.readIntLittle(u32) + 1) * 4;
+                const backward_size = (@as(u64, try hashed_reader.readIntLittle(u32)) + 1) * 4;
                 if (backward_size != index_size)
                     return error.CorruptInput;
 

lib/std/compress/xz/block.zig

@@ -98,7 +98,7 @@ pub fn Decoder(comptime ReaderType: type) type {
                 var header_hasher = std.compress.hashedReader(block_reader, Crc32.init());
                 const header_reader = header_hasher.reader();
 
-                const header_size = try header_reader.readByte() * 4;
+                const header_size = @as(u64, try header_reader.readByte()) * 4;
                 if (header_size == 0)
                     return error.EndOfStreamWithNoError;
 
@@ -217,7 +217,7 @@ pub fn Decoder(comptime ReaderType: type) type {
                     if (status == 1)
                         try self.accum.reset(self.allocator);
 
-                    const size = try packed_reader.readIntBig(u16) + 1;
+                    const size = @as(u17, try packed_reader.readIntBig(u16)) + 1;
                     try self.accum.ensureUnusedCapacity(self.allocator, size);
 
                     var i: usize = 0;

lib/std/compress/xz/test.zig

@@ -78,3 +78,23 @@ test "unsupported" {
         );
     }
 }
+
+fn testDontPanic(data: []const u8) !void {
+    const buf = decompress(data) catch |err| switch (err) {
+        error.OutOfMemory => |e| return e,
+        else => return,
+    };
+    defer testing.allocator.free(buf);
+}
+
+test "size fields: integer overflow avoidance" {
+    // These cases were found via fuzz testing and each previously caused
+    // an integer overflow when decoding. We just want to ensure they no longer
+    // cause a panic
+    const header_size_overflow = "\xfd7zXZ\x00\x00\x01i\"\xde6z";
+    try testDontPanic(header_size_overflow);
+    const lzma2_chunk_size_overflow = "\xfd7zXZ\x00\x00\x01i\"\xde6\x02\x00!\x01\x08\x00\x00\x00\xd8\x0f#\x13\x01\xff\xff";
+    try testDontPanic(lzma2_chunk_size_overflow);
+    const backward_size_overflow = "\xfd7zXZ\x00\x00\x01i\"\xde6\x00\x00\x00\x00\x1c\xdfD!\x90B\x99\r\x01\x00\x00\xff\xff\x10\x00\x00\x00\x01DD\xff\xff\xff\x01";
+    try testDontPanic(backward_size_overflow);
+}