diff options
| author | Mark Adler <madler@alumni.caltech.edu> | 2025-02-24 23:54:26 -0800 |
|---|---|---|
| committer | Mark Adler <madler@alumni.caltech.edu> | 2025-05-13 18:00:03 -0700 |
| commit | 68320827df77cda0b1d411aa18148016a8c462c3 (patch) | |
| tree | ae7f0b48862d50eedd10ae39e4099feaff89732a | |
| parent | a9bb8c48d7fa233651dbc79407df0a83f27bbeda (diff) | |
| download | zlib-68320827df77cda0b1d411aa18148016a8c462c3.tar.gz zlib-68320827df77cda0b1d411aa18148016a8c462c3.tar.bz2 zlib-68320827df77cda0b1d411aa18148016a8c462c3.zip | |
Constrain line lengths in inflate code.
| -rw-r--r-- | infback.c | 12 | ||||
| -rw-r--r-- | inffast.c | 7 | ||||
| -rw-r--r-- | inflate.c | 15 |
3 files changed, 22 insertions, 12 deletions
| @@ -353,7 +353,8 @@ int ZEXPORT inflateBack(z_streamp strm, in_func in, void FAR *in_desc, | |||
| 353 | DROPBITS(4); | 353 | DROPBITS(4); |
| 354 | #ifndef PKZIP_BUG_WORKAROUND | 354 | #ifndef PKZIP_BUG_WORKAROUND |
| 355 | if (state->nlen > 286 || state->ndist > 30) { | 355 | if (state->nlen > 286 || state->ndist > 30) { |
| 356 | strm->msg = (z_const char *)"too many length or distance symbols"; | 356 | strm->msg = (z_const char *) |
| 357 | "too many length or distance symbols"; | ||
| 357 | state->mode = BAD; | 358 | state->mode = BAD; |
| 358 | break; | 359 | break; |
| 359 | } | 360 | } |
| @@ -398,7 +399,8 @@ int ZEXPORT inflateBack(z_streamp strm, in_func in, void FAR *in_desc, | |||
| 398 | NEEDBITS(here.bits + 2); | 399 | NEEDBITS(here.bits + 2); |
| 399 | DROPBITS(here.bits); | 400 | DROPBITS(here.bits); |
| 400 | if (state->have == 0) { | 401 | if (state->have == 0) { |
| 401 | strm->msg = (z_const char *)"invalid bit length repeat"; | 402 | strm->msg = (z_const char *) |
| 403 | "invalid bit length repeat"; | ||
| 402 | state->mode = BAD; | 404 | state->mode = BAD; |
| 403 | break; | 405 | break; |
| 404 | } | 406 | } |
| @@ -421,7 +423,8 @@ int ZEXPORT inflateBack(z_streamp strm, in_func in, void FAR *in_desc, | |||
| 421 | DROPBITS(7); | 423 | DROPBITS(7); |
| 422 | } | 424 | } |
| 423 | if (state->have + copy > state->nlen + state->ndist) { | 425 | if (state->have + copy > state->nlen + state->ndist) { |
| 424 | strm->msg = (z_const char *)"invalid bit length repeat"; | 426 | strm->msg = (z_const char *) |
| 427 | "invalid bit length repeat"; | ||
| 425 | state->mode = BAD; | 428 | state->mode = BAD; |
| 426 | break; | 429 | break; |
| 427 | } | 430 | } |
| @@ -435,7 +438,8 @@ int ZEXPORT inflateBack(z_streamp strm, in_func in, void FAR *in_desc, | |||
| 435 | 438 | ||
| 436 | /* check for end-of-block code (better have one) */ | 439 | /* check for end-of-block code (better have one) */ |
| 437 | if (state->lens[256] == 0) { | 440 | if (state->lens[256] == 0) { |
| 438 | strm->msg = (z_const char *)"invalid code -- missing end-of-block"; | 441 | strm->msg = (z_const char *) |
| 442 | "invalid code -- missing end-of-block"; | ||
| 439 | state->mode = BAD; | 443 | state->mode = BAD; |
| 440 | break; | 444 | break; |
| 441 | } | 445 | } |
| @@ -155,7 +155,8 @@ void ZLIB_INTERNAL inflate_fast(z_streamp strm, unsigned start) { | |||
| 155 | dist += (unsigned)hold & ((1U << op) - 1); | 155 | dist += (unsigned)hold & ((1U << op) - 1); |
| 156 | #ifdef INFLATE_STRICT | 156 | #ifdef INFLATE_STRICT |
| 157 | if (dist > dmax) { | 157 | if (dist > dmax) { |
| 158 | strm->msg = (z_const char *)"invalid distance too far back"; | 158 | strm->msg = (z_const char *) |
| 159 | "invalid distance too far back"; | ||
| 159 | state->mode = BAD; | 160 | state->mode = BAD; |
| 160 | break; | 161 | break; |
| 161 | } | 162 | } |
| @@ -168,8 +169,8 @@ void ZLIB_INTERNAL inflate_fast(z_streamp strm, unsigned start) { | |||
| 168 | op = dist - op; /* distance back in window */ | 169 | op = dist - op; /* distance back in window */ |
| 169 | if (op > whave) { | 170 | if (op > whave) { |
| 170 | if (state->sane) { | 171 | if (state->sane) { |
| 171 | strm->msg = | 172 | strm->msg = (z_const char *) |
| 172 | (z_const char *)"invalid distance too far back"; | 173 | "invalid distance too far back"; |
| 173 | state->mode = BAD; | 174 | state->mode = BAD; |
| 174 | break; | 175 | break; |
| 175 | } | 176 | } |
| @@ -905,7 +905,8 @@ int ZEXPORT inflate(z_streamp strm, int flush) { | |||
| 905 | DROPBITS(4); | 905 | DROPBITS(4); |
| 906 | #ifndef PKZIP_BUG_WORKAROUND | 906 | #ifndef PKZIP_BUG_WORKAROUND |
| 907 | if (state->nlen > 286 || state->ndist > 30) { | 907 | if (state->nlen > 286 || state->ndist > 30) { |
| 908 | strm->msg = (z_const char *)"too many length or distance symbols"; | 908 | strm->msg = (z_const char *) |
| 909 | "too many length or distance symbols"; | ||
| 909 | state->mode = BAD; | 910 | state->mode = BAD; |
| 910 | break; | 911 | break; |
| 911 | } | 912 | } |
| @@ -952,7 +953,8 @@ int ZEXPORT inflate(z_streamp strm, int flush) { | |||
| 952 | NEEDBITS(here.bits + 2); | 953 | NEEDBITS(here.bits + 2); |
| 953 | DROPBITS(here.bits); | 954 | DROPBITS(here.bits); |
| 954 | if (state->have == 0) { | 955 | if (state->have == 0) { |
| 955 | strm->msg = (z_const char *)"invalid bit length repeat"; | 956 | strm->msg = (z_const char *) |
| 957 | "invalid bit length repeat"; | ||
| 956 | state->mode = BAD; | 958 | state->mode = BAD; |
| 957 | break; | 959 | break; |
| 958 | } | 960 | } |
| @@ -975,7 +977,8 @@ int ZEXPORT inflate(z_streamp strm, int flush) { | |||
| 975 | DROPBITS(7); | 977 | DROPBITS(7); |
| 976 | } | 978 | } |
| 977 | if (state->have + copy > state->nlen + state->ndist) { | 979 | if (state->have + copy > state->nlen + state->ndist) { |
| 978 | strm->msg = (z_const char *)"invalid bit length repeat"; | 980 | strm->msg = (z_const char *) |
| 981 | "invalid bit length repeat"; | ||
| 979 | state->mode = BAD; | 982 | state->mode = BAD; |
| 980 | break; | 983 | break; |
| 981 | } | 984 | } |
| @@ -989,7 +992,8 @@ int ZEXPORT inflate(z_streamp strm, int flush) { | |||
| 989 | 992 | ||
| 990 | /* check for end-of-block code (better have one) */ | 993 | /* check for end-of-block code (better have one) */ |
| 991 | if (state->lens[256] == 0) { | 994 | if (state->lens[256] == 0) { |
| 992 | strm->msg = (z_const char *)"invalid code -- missing end-of-block"; | 995 | strm->msg = (z_const char *) |
| 996 | "invalid code -- missing end-of-block"; | ||
| 993 | state->mode = BAD; | 997 | state->mode = BAD; |
| 994 | break; | 998 | break; |
| 995 | } | 999 | } |
| @@ -1136,7 +1140,8 @@ int ZEXPORT inflate(z_streamp strm, int flush) { | |||
| 1136 | copy = state->offset - copy; | 1140 | copy = state->offset - copy; |
| 1137 | if (copy > state->whave) { | 1141 | if (copy > state->whave) { |
| 1138 | if (state->sane) { | 1142 | if (state->sane) { |
| 1139 | strm->msg = (z_const char *)"invalid distance too far back"; | 1143 | strm->msg = (z_const char *) |
| 1144 | "invalid distance too far back"; | ||
| 1140 | state->mode = BAD; | 1145 | state->mode = BAD; |
| 1141 | break; | 1146 | break; |
| 1142 | } | 1147 | } |
