From d7637afda9f89bcff6c212ba8d1dbc211f128218 Mon Sep 17 00:00:00 2001 From: VirajMishra1 Date: Mon, 7 Sep 2026 21:44:37 -0400 Subject: [PATCH] fix: update customDictContentEnd after ZDICT_finalizeDictionary in COVER_selectDict customDictContentEnd was computed from dictContentSize before the call to ZDICT_finalizeDictionary(), which overwrites dictContentSize with the actual finalized size (including the dictionary header). The stale pointer was then used in the shrinkDict loop to compute candidate content slices, referencing bytes past the true end of the custom content. Fix: recompute customDictContentEnd immediately after the call, once dictContentSize reflects the finalized value. Fixes #4750 --- lib/dictBuilder/cover.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/dictBuilder/cover.c b/lib/dictBuilder/cover.c index 06d1cb93a5c..dfa4dbf96db 100644 --- a/lib/dictBuilder/cover.c +++ b/lib/dictBuilder/cover.c @@ -1075,6 +1075,10 @@ COVER_dictSelection_t COVER_selectDict(BYTE* customDictContent, size_t dictBuffe free(candidateDictBuffer); return COVER_dictSelectionError(dictContentSize); } + /* Update customDictContentEnd to reflect the actual size after finalization. + * ZDICT_finalizeDictionary() may shrink dictContentSize by adding the header, + * so the pointer computed before the call would be stale. */ + customDictContentEnd = customDictContent + dictContentSize; totalCompressedSize = COVER_checkTotalCompressedSize(params, samplesSizes, samplesBuffer, offsets,