Repository: syncthing/syncthing (language: go)

Issue:
Connection dropped in loop with "lz4: invalid source or destination buffer too short" when sending files to Syncthing i386 with "All Data" compression enabled
The problem seems to only affect specific files. I'm attaching a sample file that does it below.

1. Connect two devices together. Make sure Device B runs the i386 (32-bit x86) release of Syncthing. Not sure if all platforms are affected, as I've only tested this under Windows.
2. On Device A, enable "All Data" compression for Device B. Disconnect and reconnect the two devices for the setting to trigger.
3. Share a new empty folder between the two devices.
4. On Device B, add `libsyncthing.so` (download and unpack from https://github.com/syncthing/syncthing/files/9259401/libsyncthing.zip) to the folder.
5. Device B fails to sync the file and drops the connection with
   ```
   [IDWWV] 2022/08/04 13:50:27.520397 model.go:1770: INFO: Connection to DHK2GDE at 192.168.56.1:50440-192.168.56.1:51355/tcp-server/TLS1.3-TLS_CHACHA20_POLY1305_SHA256 closed: decompressing message: lz4: invalid source or destination buffer too short
   ```
7. From now on, the two devices keep trying to reconnect, but the connection keeps dropping immediately with the same error.

The only way to work around the the problem seems to be not using "All Data" compression.

Logs with `db,model,connections` enabled.

- [DeviceA.log](https://github.com/syncthing/syncthing/files/9259465/DeviceA.log)
- [DeviceB.log](https://github.com/syncthing/syncthing/files/9259466/DeviceB.log)




Discussion / hints:
LZ4 package bug: https://github.com/pierrec/lz4/pull/191
There's been no response on the LZ4 package repository (and no changes to the package itself since June). What do you think about simply downgrading the package to v4.1.13 for the time being, which seems to work fine on i386 systems (at least when it comes to Windows)?

This can be done by just reverting https://github.com/syncthing/syncthing/commit/2e135d0c6540a911fa9f8912897151e716a567a1. I did that one month ago and I've been using v4.1.13 on my Windows x86 machine since then with no further issues, without any other changes to the configuration, etc.
Yeah. One "worry" is that we don't have a process for keeping dependencies locked at a lower version; dependabot will complain, `build.sh update-deps` will upgrade it, etc... It might be safer even to fork it and revert the offending commit, then do a `replace` in go.mod. Debian etc will hate it, of course, but that's how it is.
Should such a fork be done by an individual (e.g. myself) or by Syncthing?
I guess by whoever wants to be the new maintainer of the lz4 package in perpetuity...
Reverting the commit causes a regression. I've sent a better fix to lz4.

Fix patch:
diff --git a/go.mod b/go.mod
index b6774024cf8..ceafbd3b7c6 100644
--- a/go.mod
+++ b/go.mod
@@ -36,7 +36,7 @@ require (
 	github.com/minio/sha256-simd v1.0.0
 	github.com/miscreant/miscreant.go v0.0.0-20200214223636-26d376326b75
 	github.com/oschwald/geoip2-golang v1.5.0
-	github.com/pierrec/lz4/v4 v4.1.15
+	github.com/pierrec/lz4/v4 v4.1.16
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/prometheus/client_golang v1.12.2
 	github.com/prometheus/common v0.32.1 // indirect
diff --git a/go.sum b/go.sum
index e1f84a8e818..f70bc5c1b9a 100644
--- a/go.sum
+++ b/go.sum
@@ -313,6 +313,8 @@ github.com/petermattis/goid v0.0.0-20180202154549-b0b1615b78e5 h1:q2e307iGHPdTGp
 github.com/petermattis/goid v0.0.0-20180202154549-b0b1615b78e5/go.mod h1:jvVRKCrJTQWu0XVbaOlby/2lO20uSCHEMzzplHXte1o=
 github.com/pierrec/lz4/v4 v4.1.15 h1:MO0/ucJhngq7299dKLwIMtgTfbkoSPF6AoMYDd8Q4q0=
 github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/pierrec/lz4/v4 v4.1.16 h1:kQPfno+wyx6C5572ABwV+Uo3pDFzQ7yhyGchSyRda0c=
+github.com/pierrec/lz4/v4 v4.1.16/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=


Test patch: