aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEd Maste <emaste@FreeBSD.org>2022-04-05 23:33:30 +0000
committerEd Maste <emaste@FreeBSD.org>2022-04-05 23:33:30 +0000
commit9854ff0880022ebc0bd955a57bc1322228790f99 (patch)
tree7bbb2377d30613dcde611fa864d74ce56c02c35a
parentb00046e52698fd44ef4f8db3dbda6b8d0fcbefb0 (diff)
downloadsrc-9854ff0880022ebc0bd955a57bc1322228790f99.tar.gz
src-9854ff0880022ebc0bd955a57bc1322228790f99.zip
Assure that the number of bits for deflatePrime() is valid.
Cherry picked from zlib 4346a16853e19b45787ce933666026903fb8f3f8 Approved by: so Security: FreeBSD-SA-22:08.zlib
-rw-r--r--sys/contrib/zlib/deflate.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/contrib/zlib/deflate.c b/sys/contrib/zlib/deflate.c
index edbeec0dd09a..f453517668ca 100644
--- a/sys/contrib/zlib/deflate.c
+++ b/sys/contrib/zlib/deflate.c
@@ -589,7 +589,8 @@ int ZEXPORT deflatePrime (strm, bits, value)
if (deflateStateCheck(strm)) return Z_STREAM_ERROR;
s = strm->state;
- if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
+ if (bits < 0 || bits > 16 ||
+ s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
return Z_BUF_ERROR;
do {
put = Buf_size - s->bi_valid;