Backport fixes for CVE-2025-67721

src/main/java/io/airlift/compress/lz4/Lz4RawDecompressor.java

@@ -114,7 +114,7 @@ public static int decompress(
             input += SIZE_OF_SHORT;
 
             long matchAddress = output - offset;
-            if (matchAddress < outputAddress) {
+            if (matchAddress < outputAddress || matchAddress >= output) {
                 throw new MalformedInputException(input - inputAddress, "offset outside destination buffer");
             }
 

src/main/java/io/airlift/compress/snappy/SnappyRawDecompressor.java

@@ -150,7 +150,7 @@ private static int uncompressAll(
                 // bit 8).
                 int matchOffset = entry & 0x700;
                 matchOffset += trailer;
-                if (matchOffset < 0) {
+                if (matchOffset <= 0) {
                     throw new MalformedInputException(input - inputAddress);
                 }
 

src/test/java/io/airlift/compress/lz4/TestLz4.java

@@ -93,6 +93,16 @@ public void testMatchLengthOverflow()
         byte[] data = buffer.toByteArray();
 
         assertThatThrownBy(() -> new Lz4Decompressor().decompress(data, 0, data.length, new byte[2048], 0, 2048))
-                .isInstanceOf(MalformedInputException.class);
+                .isInstanceOf(MalformedInputException.class)
+                .hasMessageMatching("Malformed input.*|Unknown error occurred.*|offset outside destination buffer.*");
+    }
+
+    @Test
+    void testZeroMatchOffset()
+    {
+        byte[] compressed = new byte[] {15, 0, 0, -1, -1, -118, 49, -1, -1, 0};
+        assertThatThrownBy(() -> getDecompressor().decompress(compressed, 0, compressed.length, new byte[1024], 0, 1024))
+                .isInstanceOf(MalformedInputException.class)
+                .hasMessageContaining("offset outside destination buffer: offset=3");
     }
 }

src/test/java/io/airlift/compress/snappy/TestSnappy.java

@@ -77,4 +77,13 @@ public void testNegativeLength()
                 .isInstanceOf(MalformedInputException.class)
                 .hasMessageStartingWith("negative compressed length");
     }
+
+    @Test
+    void testZeroMatchOffsetFails()
+    {
+        byte[] zeroMatchOffset = new byte[] {16, 1, 0, 1, 0, 1, 0, 1, 0};
+        assertThatThrownBy(() -> new SnappyDecompressor().decompress(zeroMatchOffset, 0, zeroMatchOffset.length, new byte[64], 0, 64))
+                .isInstanceOf(MalformedInputException.class)
+                .hasMessageContaining("Malformed input: offset=2");
+    }
 }