diff options
| author | Ed Maste <emaste@FreeBSD.org> | 2022-04-05 23:33:30 +0000 |
|---|---|---|
| committer | Ed Maste <emaste@FreeBSD.org> | 2022-04-05 23:33:30 +0000 |
| commit | 9854ff0880022ebc0bd955a57bc1322228790f99 (patch) | |
| tree | 7bbb2377d30613dcde611fa864d74ce56c02c35a | |
| parent | b00046e52698fd44ef4f8db3dbda6b8d0fcbefb0 (diff) | |
| download | src-9854ff0880022ebc0bd955a57bc1322228790f99.tar.gz src-9854ff0880022ebc0bd955a57bc1322228790f99.zip | |
Assure that the number of bits for deflatePrime() is valid.
Cherry picked from zlib 4346a16853e19b45787ce933666026903fb8f3f8
Approved by: so
Security: FreeBSD-SA-22:08.zlib
| -rw-r--r-- | sys/contrib/zlib/deflate.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/contrib/zlib/deflate.c b/sys/contrib/zlib/deflate.c index edbeec0dd09a..f453517668ca 100644 --- a/sys/contrib/zlib/deflate.c +++ b/sys/contrib/zlib/deflate.c @@ -589,7 +589,8 @@ int ZEXPORT deflatePrime (strm, bits, value) if (deflateStateCheck(strm)) return Z_STREAM_ERROR; s = strm->state; - if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3)) + if (bits < 0 || bits > 16 || + s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3)) return Z_BUF_ERROR; do { put = Buf_size - s->bi_valid; |