ZSTD_CCtx_reset(session_only) keeps pending stable input: next frame reads before the caller's buffer #4868

Describe the bug

With ZSTD_c_stableInBuffer=1, ZSTD_compressStream2(..., ZSTD_e_continue) on less than one block of input "pretends" to consume it and records the amount in cctx->stableIn_notConsumed (transparent initialization stage of ZSTD_compressStream2 in lib/compress/zstd_compress.c). If the frame is then abandoned with ZSTD_CCtx_reset(cctx, ZSTD_reset_session_only), stableIn_notConsumed is not cleared. The next frame adds it to its input size and later subtracts it from the new input->pos (input->pos -= cctx->stableIn_notConsumed in ZSTD_compressStream_generic and in the ZSTDMT branch). Compression therefore starts stableIn_notConsumed bytes before the caller's new buffer.

Effects:

• out-of-bounds read of up to one block (128 KB) before the new input buffer (AddressSanitizer: heap-buffer-overflow);
• in release builds the call succeeds and the frame silently contains those bytes, so the output is wrong, adjacent memory is disclosed, and the frame content size is too large;
• assert(input->pos >= cctx->stableIn_notConsumed) fires in debug builds.

ZSTD_CCtx_reset documents a session reset as abandoning the current frame, so starting a new frame afterwards is a valid sequence.

To Reproduce (zstd dev at 49cf517, Linux x86-64, gcc 13)

#define ZSTD_STATIC_LINKING_ONLY
#include <zstd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(void)
{
    size_t const n1 = 1000, n2 = 50000, cap = ZSTD_compressBound(n1 + n2);
    char* first = malloc(n1); char* second = malloc(n2);
    char* dst = malloc(cap); char* back = malloc(n1 + n2);
    ZSTD_CCtx* cctx = ZSTD_createCCtx();
    memset(first, 'a', n1); memset(second, 'b', n2);
    ZSTD_CCtx_setParameter(cctx, ZSTD_c_stableInBuffer, 1);

    {   ZSTD_inBuffer in = { first, n1, 0 }; ZSTD_outBuffer out = { dst, cap, 0 };
        ZSTD_compressStream2(cctx, &out, &in, ZSTD_e_continue);   /* pending, not compressed */
    }
    ZSTD_CCtx_reset(cctx, ZSTD_reset_session_only);              /* abandon frame 1 */

    {   ZSTD_inBuffer in = { second, n2, 0 }; ZSTD_outBuffer out = { dst, cap, 0 };
        size_t const r = ZSTD_compressStream2(cctx, &out, &in, ZSTD_e_end);
        size_t const d = ZSTD_decompress(back, n1 + n2, dst, out.pos);
        printf("r=%zu content size %llu, decompressed %zu (expected %zu)\n", r,
               ZSTD_getFrameContentSize(dst, out.pos), d, n2);
    }
    return 0;
}

Release build output:

r=0 content size 51000, decompressed 51000 (expected 50000)

With -fsanitize=address:

ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 8
    #0 MEM_read64 lib/common/mem.h:184
    ...
    #4 ZSTD_compressBlock_doubleFast_noDict_generic lib/compress/zstd_double_fast.c:176
    ...
    #10 ZSTD_compressContinue_internal lib/compress/zstd_compress.c:4863
    #11 ZSTD_compressEnd_public lib/compress/zstd_compress.c:5441
    #12 ZSTD_compressStream_generic lib/compress/zstd_compress.c:6180
    #13 ZSTD_compressStream2 lib/compress/zstd_compress.c:6569

Expected behavior

The second frame contains exactly the second buffer (50000 bytes), and nothing outside it is read.

Suggested fix

Clear the pending stable input when the session is reset:

 size_t ZSTD_CCtx_reset(ZSTD_CCtx* cctx, ZSTD_ResetDirective reset)
 {
     if ( (reset == ZSTD_reset_session_only)
       || (reset == ZSTD_reset_session_and_parameters) ) {
         cctx->streamStage = zcss_init;
         cctx->pledgedSrcSizePlusOne = 0;
+        cctx->stableIn_notConsumed = 0;
     }

With this change the reproducer prints content size 50000, decompressed 50000 (expected 50000).

Environment

• zstd dev branch, commit 49cf517 (v1.6.0-dev)
• Ubuntu 24.04, x86-64, gcc 13.3

Found while stress-testing a match-finder change with randomized streaming cases; reproduced on unmodified dev.