Fix int64_t overflow in signed varint decoder

src/fstapi.c

@@ -617,26 +617,27 @@ static int fstWriterVarint(FILE *handle, uint64_t v)
 static int64_t fstGetSVarint64(unsigned char *mem, int *skiplen)
 {
     unsigned char *mem_orig = mem;
-    int64_t rc = 0;
-    const int64_t one = 1;
+    uint64_t rc = 0;
     const int siz = sizeof(int64_t) * 8;
     int shift = 0;
     unsigned char byt;
 
     do {
         byt = *(mem++);
-        rc |= ((int64_t)(byt & 0x7f)) << shift;
+        if (shift < siz) {
+            rc |= ((uint64_t)(byt & 0x7f)) << shift;
+        }
         shift += 7;
 
     } while (byt & 0x80);
 
     if ((shift < siz) && (byt & 0x40)) {
-        rc |= -(one << shift); /* sign extend */
+        rc |= ~(uint64_t)0 << shift; /* sign extend */
     }
 
     *skiplen = mem - mem_orig;
 
-    return (rc);
+    return ((int64_t)rc);
 }
 
 #ifndef FST_DYNAMIC_ALIAS2_DISABLE

tests/meson.build

@@ -25,6 +25,7 @@ malformed_cases = [
     'chain_shorter_than_its_length',
     'chain_table_overrun',
     'chain_table_pair_unterminated',
+    'chain_table_svarint_overlong',
     'chain_table_unterminated',
     'chain_uncompresses_past_traversal',
     'chain_varint_pair_past_traversal',

tests/reader_malformed_files.c

@@ -33,6 +33,11 @@
  *       starts runs off the end of the table, reads as the zero that means
  *       "this entry is two varints", and the second varint is not there
  *
+ *   chain_table_svarint_overlong.fst
+ *       a chain table holding two signed varints: one nine bytes long, ending
+ *       at bit 63 with its sign bit set, and one eleven bytes long, with bit
+ *       63 set and bits past the 64th
+ *
  *   chain_table_unterminated.fst
  *       the last byte of a chain table asks for another byte, so a parse that
  *       stops on reaching the end of the table exactly runs past it