aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMark Adler <madler@alumni.caltech.edu>2025-02-24 23:54:26 -0800
committerMark Adler <madler@alumni.caltech.edu>2025-05-13 18:00:03 -0700
commit68320827df77cda0b1d411aa18148016a8c462c3 (patch)
treeae7f0b48862d50eedd10ae39e4099feaff89732a
parenta9bb8c48d7fa233651dbc79407df0a83f27bbeda (diff)
downloadzlib-68320827df77cda0b1d411aa18148016a8c462c3.tar.gz
zlib-68320827df77cda0b1d411aa18148016a8c462c3.tar.bz2
zlib-68320827df77cda0b1d411aa18148016a8c462c3.zip
Constrain line lengths in inflate code.
-rw-r--r--infback.c12
-rw-r--r--inffast.c7
-rw-r--r--inflate.c15
3 files changed, 22 insertions, 12 deletions
diff --git a/infback.c b/infback.c
index 6c7a034a..78e98422 100644
--- a/infback.c
+++ b/infback.c
@@ -353,7 +353,8 @@ int ZEXPORT inflateBack(z_streamp strm, in_func in, void FAR *in_desc,
353 DROPBITS(4); 353 DROPBITS(4);
354#ifndef PKZIP_BUG_WORKAROUND 354#ifndef PKZIP_BUG_WORKAROUND
355 if (state->nlen > 286 || state->ndist > 30) { 355 if (state->nlen > 286 || state->ndist > 30) {
356 strm->msg = (z_const char *)"too many length or distance symbols"; 356 strm->msg = (z_const char *)
357 "too many length or distance symbols";
357 state->mode = BAD; 358 state->mode = BAD;
358 break; 359 break;
359 } 360 }
@@ -398,7 +399,8 @@ int ZEXPORT inflateBack(z_streamp strm, in_func in, void FAR *in_desc,
398 NEEDBITS(here.bits + 2); 399 NEEDBITS(here.bits + 2);
399 DROPBITS(here.bits); 400 DROPBITS(here.bits);
400 if (state->have == 0) { 401 if (state->have == 0) {
401 strm->msg = (z_const char *)"invalid bit length repeat"; 402 strm->msg = (z_const char *)
403 "invalid bit length repeat";
402 state->mode = BAD; 404 state->mode = BAD;
403 break; 405 break;
404 } 406 }
@@ -421,7 +423,8 @@ int ZEXPORT inflateBack(z_streamp strm, in_func in, void FAR *in_desc,
421 DROPBITS(7); 423 DROPBITS(7);
422 } 424 }
423 if (state->have + copy > state->nlen + state->ndist) { 425 if (state->have + copy > state->nlen + state->ndist) {
424 strm->msg = (z_const char *)"invalid bit length repeat"; 426 strm->msg = (z_const char *)
427 "invalid bit length repeat";
425 state->mode = BAD; 428 state->mode = BAD;
426 break; 429 break;
427 } 430 }
@@ -435,7 +438,8 @@ int ZEXPORT inflateBack(z_streamp strm, in_func in, void FAR *in_desc,
435 438
436 /* check for end-of-block code (better have one) */ 439 /* check for end-of-block code (better have one) */
437 if (state->lens[256] == 0) { 440 if (state->lens[256] == 0) {
438 strm->msg = (z_const char *)"invalid code -- missing end-of-block"; 441 strm->msg = (z_const char *)
442 "invalid code -- missing end-of-block";
439 state->mode = BAD; 443 state->mode = BAD;
440 break; 444 break;
441 } 445 }
diff --git a/inffast.c b/inffast.c
index f7b550b8..c9ea95c7 100644
--- a/inffast.c
+++ b/inffast.c
@@ -155,7 +155,8 @@ void ZLIB_INTERNAL inflate_fast(z_streamp strm, unsigned start) {
155 dist += (unsigned)hold & ((1U << op) - 1); 155 dist += (unsigned)hold & ((1U << op) - 1);
156#ifdef INFLATE_STRICT 156#ifdef INFLATE_STRICT
157 if (dist > dmax) { 157 if (dist > dmax) {
158 strm->msg = (z_const char *)"invalid distance too far back"; 158 strm->msg = (z_const char *)
159 "invalid distance too far back";
159 state->mode = BAD; 160 state->mode = BAD;
160 break; 161 break;
161 } 162 }
@@ -168,8 +169,8 @@ void ZLIB_INTERNAL inflate_fast(z_streamp strm, unsigned start) {
168 op = dist - op; /* distance back in window */ 169 op = dist - op; /* distance back in window */
169 if (op > whave) { 170 if (op > whave) {
170 if (state->sane) { 171 if (state->sane) {
171 strm->msg = 172 strm->msg = (z_const char *)
172 (z_const char *)"invalid distance too far back"; 173 "invalid distance too far back";
173 state->mode = BAD; 174 state->mode = BAD;
174 break; 175 break;
175 } 176 }
diff --git a/inflate.c b/inflate.c
index 4feac091..d6779955 100644
--- a/inflate.c
+++ b/inflate.c
@@ -905,7 +905,8 @@ int ZEXPORT inflate(z_streamp strm, int flush) {
905 DROPBITS(4); 905 DROPBITS(4);
906#ifndef PKZIP_BUG_WORKAROUND 906#ifndef PKZIP_BUG_WORKAROUND
907 if (state->nlen > 286 || state->ndist > 30) { 907 if (state->nlen > 286 || state->ndist > 30) {
908 strm->msg = (z_const char *)"too many length or distance symbols"; 908 strm->msg = (z_const char *)
909 "too many length or distance symbols";
909 state->mode = BAD; 910 state->mode = BAD;
910 break; 911 break;
911 } 912 }
@@ -952,7 +953,8 @@ int ZEXPORT inflate(z_streamp strm, int flush) {
952 NEEDBITS(here.bits + 2); 953 NEEDBITS(here.bits + 2);
953 DROPBITS(here.bits); 954 DROPBITS(here.bits);
954 if (state->have == 0) { 955 if (state->have == 0) {
955 strm->msg = (z_const char *)"invalid bit length repeat"; 956 strm->msg = (z_const char *)
957 "invalid bit length repeat";
956 state->mode = BAD; 958 state->mode = BAD;
957 break; 959 break;
958 } 960 }
@@ -975,7 +977,8 @@ int ZEXPORT inflate(z_streamp strm, int flush) {
975 DROPBITS(7); 977 DROPBITS(7);
976 } 978 }
977 if (state->have + copy > state->nlen + state->ndist) { 979 if (state->have + copy > state->nlen + state->ndist) {
978 strm->msg = (z_const char *)"invalid bit length repeat"; 980 strm->msg = (z_const char *)
981 "invalid bit length repeat";
979 state->mode = BAD; 982 state->mode = BAD;
980 break; 983 break;
981 } 984 }
@@ -989,7 +992,8 @@ int ZEXPORT inflate(z_streamp strm, int flush) {
989 992
990 /* check for end-of-block code (better have one) */ 993 /* check for end-of-block code (better have one) */
991 if (state->lens[256] == 0) { 994 if (state->lens[256] == 0) {
992 strm->msg = (z_const char *)"invalid code -- missing end-of-block"; 995 strm->msg = (z_const char *)
996 "invalid code -- missing end-of-block";
993 state->mode = BAD; 997 state->mode = BAD;
994 break; 998 break;
995 } 999 }
@@ -1136,7 +1140,8 @@ int ZEXPORT inflate(z_streamp strm, int flush) {
1136 copy = state->offset - copy; 1140 copy = state->offset - copy;
1137 if (copy > state->whave) { 1141 if (copy > state->whave) {
1138 if (state->sane) { 1142 if (state->sane) {
1139 strm->msg = (z_const char *)"invalid distance too far back"; 1143 strm->msg = (z_const char *)
1144 "invalid distance too far back";
1140 state->mode = BAD; 1145 state->mode = BAD;
1141 break; 1146 break;
1142 } 1147 }