fix: fixed potential overflow when compressing integer

[sssooonnnggg]

Description of Change(s)

When compressing integer, capacity passed to LZ4 is incorrect, because we already passed compressed + 1 as output ptr, the capacity parameter should be LZ4_compressBound instead of LZ4_compressBound + 1.

FYI, the caller in crateFile.cpp only allocate a buffer with compressBound + 1 size :

Then inside the callee, we passed LZ4 an incorrect capacity larger than actual, which causes undefined behaviour when serializing usdc files

Fixes Issue(s)

• I have verified that all unit tests pass with the proposed changes

• I have submitted a signed Contributor License Agreement

[jesschimein]

Filed as internal issue #USD-8634

[gitamohr]

Nice catch, thanks!

[sssooonnnggg]

@gitamohr Hi, can this PR be merged? We are currently using a custom repo with the fix, and cannot use the upstream code.😄

[spiffmon]

It has been committed internally to Pixar, and should be flowing out to GitHub dev branch shortly!

…

On Tue, Mar 12, 2024 at 4:20 AM Song ***@***.***> wrote: @gitamohr <https://github.com/gitamohr> Hi, can this PR be merged? We are currently using a custom repo with the fix, and cannot use the upstream code.😄 — Reply to this email directly, view it on GitHub <#2631 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABPOU2FRIJMJNNE6WSA7GH3YX3QHLAVCNFSM6AAAAAA4CVBRRWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSOJRGQYTGNBQHA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>