aboutsummaryrefslogtreecommitdiff
path: root/inflate.c
diff options
context:
space:
mode:
authorMark Adler <madler@alumni.caltech.edu>2016-10-24 20:11:41 -0700
committerMark Adler <madler@alumni.caltech.edu>2016-10-24 21:07:43 -0700
commitb516b4bdd7c0c9f0858adfebf732089014f7b282 (patch)
treefcee291aca78e7bf475e0060e42f18a40174c947 /inflate.c
parent77fd7e56bfc75b4194145060bb1ec5256ce077c6 (diff)
downloadzlib-b516b4bdd7c0c9f0858adfebf732089014f7b282.tar.gz
zlib-b516b4bdd7c0c9f0858adfebf732089014f7b282.tar.bz2
zlib-b516b4bdd7c0c9f0858adfebf732089014f7b282.zip
Do a more thorough check of the state for every stream call.
This verifies that the state has been initialized, that it is the expected type of state, deflate or inflate, and that at least the first several bytes of the internal state have not been clobbered.
Diffstat (limited to 'inflate.c')
-rw-r--r--inflate.c51
1 files changed, 34 insertions, 17 deletions
diff --git a/inflate.c b/inflate.c
index eb1b4ce..0372edf 100644
--- a/inflate.c
+++ b/inflate.c
@@ -92,6 +92,7 @@
92#endif 92#endif
93 93
94/* function prototypes */ 94/* function prototypes */
95local int inflateStateCheck OF((z_streamp strm));
95local void fixedtables OF((struct inflate_state FAR *state)); 96local void fixedtables OF((struct inflate_state FAR *state));
96local int updatewindow OF((z_streamp strm, const unsigned char FAR *end, 97local int updatewindow OF((z_streamp strm, const unsigned char FAR *end,
97 unsigned copy)); 98 unsigned copy));
@@ -101,12 +102,26 @@ local int updatewindow OF((z_streamp strm, const unsigned char FAR *end,
101local unsigned syncsearch OF((unsigned FAR *have, const unsigned char FAR *buf, 102local unsigned syncsearch OF((unsigned FAR *have, const unsigned char FAR *buf,
102 unsigned len)); 103 unsigned len));
103 104
105local int inflateStateCheck(strm)
106z_streamp strm;
107{
108 struct inflate_state FAR *state;
109 if (strm == Z_NULL ||
110 strm->zalloc == (alloc_func)0 || strm->zfree == (free_func)0)
111 return 1;
112 state = (struct inflate_state FAR *)strm->state;
113 if (state == Z_NULL || state->strm != strm ||
114 state->mode < HEAD || state->mode > SYNC)
115 return 1;
116 return 0;
117}
118
104int ZEXPORT inflateResetKeep(strm) 119int ZEXPORT inflateResetKeep(strm)
105z_streamp strm; 120z_streamp strm;
106{ 121{
107 struct inflate_state FAR *state; 122 struct inflate_state FAR *state;
108 123
109 if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; 124 if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
110 state = (struct inflate_state FAR *)strm->state; 125 state = (struct inflate_state FAR *)strm->state;
111 strm->total_in = strm->total_out = state->total = 0; 126 strm->total_in = strm->total_out = state->total = 0;
112 strm->msg = Z_NULL; 127 strm->msg = Z_NULL;
@@ -131,7 +146,7 @@ z_streamp strm;
131{ 146{
132 struct inflate_state FAR *state; 147 struct inflate_state FAR *state;
133 148
134 if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; 149 if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
135 state = (struct inflate_state FAR *)strm->state; 150 state = (struct inflate_state FAR *)strm->state;
136 state->wsize = 0; 151 state->wsize = 0;
137 state->whave = 0; 152 state->whave = 0;
@@ -147,7 +162,7 @@ int windowBits;
147 struct inflate_state FAR *state; 162 struct inflate_state FAR *state;
148 163
149 /* get the state */ 164 /* get the state */
150 if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; 165 if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
151 state = (struct inflate_state FAR *)strm->state; 166 state = (struct inflate_state FAR *)strm->state;
152 167
153 /* extract wrap request from windowBits parameter */ 168 /* extract wrap request from windowBits parameter */
@@ -210,7 +225,9 @@ int stream_size;
210 if (state == Z_NULL) return Z_MEM_ERROR; 225 if (state == Z_NULL) return Z_MEM_ERROR;
211 Tracev((stderr, "inflate: allocated\n")); 226 Tracev((stderr, "inflate: allocated\n"));
212 strm->state = (struct internal_state FAR *)state; 227 strm->state = (struct internal_state FAR *)state;
228 state->strm = strm;
213 state->window = Z_NULL; 229 state->window = Z_NULL;
230 state->mode = HEAD; /* to pass state test in inflateReset2() */
214 ret = inflateReset2(strm, windowBits); 231 ret = inflateReset2(strm, windowBits);
215 if (ret != Z_OK) { 232 if (ret != Z_OK) {
216 ZFREE(strm, state); 233 ZFREE(strm, state);
@@ -234,7 +251,7 @@ int value;
234{ 251{
235 struct inflate_state FAR *state; 252 struct inflate_state FAR *state;
236 253
237 if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; 254 if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
238 state = (struct inflate_state FAR *)strm->state; 255 state = (struct inflate_state FAR *)strm->state;
239 if (bits < 0) { 256 if (bits < 0) {
240 state->hold = 0; 257 state->hold = 0;
@@ -625,7 +642,7 @@ int flush;
625 static const unsigned short order[19] = /* permutation of code lengths */ 642 static const unsigned short order[19] = /* permutation of code lengths */
626 {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15}; 643 {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
627 644
628 if (strm == Z_NULL || strm->state == Z_NULL || strm->next_out == Z_NULL || 645 if (inflateStateCheck(strm) || strm->next_out == Z_NULL ||
629 (strm->next_in == Z_NULL && strm->avail_in != 0)) 646 (strm->next_in == Z_NULL && strm->avail_in != 0))
630 return Z_STREAM_ERROR; 647 return Z_STREAM_ERROR;
631 648
@@ -1261,7 +1278,7 @@ int ZEXPORT inflateEnd(strm)
1261z_streamp strm; 1278z_streamp strm;
1262{ 1279{
1263 struct inflate_state FAR *state; 1280 struct inflate_state FAR *state;
1264 if (strm == Z_NULL || strm->state == Z_NULL || strm->zfree == (free_func)0) 1281 if (inflateStateCheck(strm))
1265 return Z_STREAM_ERROR; 1282 return Z_STREAM_ERROR;
1266 state = (struct inflate_state FAR *)strm->state; 1283 state = (struct inflate_state FAR *)strm->state;
1267 if (state->window != Z_NULL) ZFREE(strm, state->window); 1284 if (state->window != Z_NULL) ZFREE(strm, state->window);
@@ -1279,7 +1296,7 @@ uInt *dictLength;
1279 struct inflate_state FAR *state; 1296 struct inflate_state FAR *state;
1280 1297
1281 /* check state */ 1298 /* check state */
1282 if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; 1299 if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
1283 state = (struct inflate_state FAR *)strm->state; 1300 state = (struct inflate_state FAR *)strm->state;
1284 1301
1285 /* copy dictionary */ 1302 /* copy dictionary */
@@ -1304,7 +1321,7 @@ uInt dictLength;
1304 int ret; 1321 int ret;
1305 1322
1306 /* check state */ 1323 /* check state */
1307 if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; 1324 if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
1308 state = (struct inflate_state FAR *)strm->state; 1325 state = (struct inflate_state FAR *)strm->state;
1309 if (state->wrap != 0 && state->mode != DICT) 1326 if (state->wrap != 0 && state->mode != DICT)
1310 return Z_STREAM_ERROR; 1327 return Z_STREAM_ERROR;
@@ -1336,7 +1353,7 @@ gz_headerp head;
1336 struct inflate_state FAR *state; 1353 struct inflate_state FAR *state;
1337 1354
1338 /* check state */ 1355 /* check state */
1339 if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; 1356 if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
1340 state = (struct inflate_state FAR *)strm->state; 1357 state = (struct inflate_state FAR *)strm->state;
1341 if ((state->wrap & 2) == 0) return Z_STREAM_ERROR; 1358 if ((state->wrap & 2) == 0) return Z_STREAM_ERROR;
1342 1359
@@ -1389,7 +1406,7 @@ z_streamp strm;
1389 struct inflate_state FAR *state; 1406 struct inflate_state FAR *state;
1390 1407
1391 /* check parameters */ 1408 /* check parameters */
1392 if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; 1409 if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
1393 state = (struct inflate_state FAR *)strm->state; 1410 state = (struct inflate_state FAR *)strm->state;
1394 if (strm->avail_in == 0 && state->bits < 8) return Z_BUF_ERROR; 1411 if (strm->avail_in == 0 && state->bits < 8) return Z_BUF_ERROR;
1395 1412
@@ -1436,7 +1453,7 @@ z_streamp strm;
1436{ 1453{
1437 struct inflate_state FAR *state; 1454 struct inflate_state FAR *state;
1438 1455
1439 if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; 1456 if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
1440 state = (struct inflate_state FAR *)strm->state; 1457 state = (struct inflate_state FAR *)strm->state;
1441 return state->mode == STORED && state->bits == 0; 1458 return state->mode == STORED && state->bits == 0;
1442} 1459}
@@ -1451,8 +1468,7 @@ z_streamp source;
1451 unsigned wsize; 1468 unsigned wsize;
1452 1469
1453 /* check input */ 1470 /* check input */
1454 if (dest == Z_NULL || source == Z_NULL || source->state == Z_NULL || 1471 if (inflateStateCheck(source) || dest == Z_NULL)
1455 source->zalloc == (alloc_func)0 || source->zfree == (free_func)0)
1456 return Z_STREAM_ERROR; 1472 return Z_STREAM_ERROR;
1457 state = (struct inflate_state FAR *)source->state; 1473 state = (struct inflate_state FAR *)source->state;
1458 1474
@@ -1473,6 +1489,7 @@ z_streamp source;
1473 /* copy state */ 1489 /* copy state */
1474 zmemcpy((voidpf)dest, (voidpf)source, sizeof(z_stream)); 1490 zmemcpy((voidpf)dest, (voidpf)source, sizeof(z_stream));
1475 zmemcpy((voidpf)copy, (voidpf)state, sizeof(struct inflate_state)); 1491 zmemcpy((voidpf)copy, (voidpf)state, sizeof(struct inflate_state));
1492 copy->strm = dest;
1476 if (state->lencode >= state->codes && 1493 if (state->lencode >= state->codes &&
1477 state->lencode <= state->codes + ENOUGH - 1) { 1494 state->lencode <= state->codes + ENOUGH - 1) {
1478 copy->lencode = copy->codes + (state->lencode - state->codes); 1495 copy->lencode = copy->codes + (state->lencode - state->codes);
@@ -1494,7 +1511,7 @@ int subvert;
1494{ 1511{
1495 struct inflate_state FAR *state; 1512 struct inflate_state FAR *state;
1496 1513
1497 if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; 1514 if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
1498 state = (struct inflate_state FAR *)strm->state; 1515 state = (struct inflate_state FAR *)strm->state;
1499#ifdef INFLATE_ALLOW_INVALID_DISTANCE_TOOFAR_ARRR 1516#ifdef INFLATE_ALLOW_INVALID_DISTANCE_TOOFAR_ARRR
1500 state->sane = !subvert; 1517 state->sane = !subvert;
@@ -1512,7 +1529,7 @@ int check;
1512{ 1529{
1513 struct inflate_state FAR *state; 1530 struct inflate_state FAR *state;
1514 1531
1515 if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; 1532 if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
1516 state = (struct inflate_state FAR *)strm->state; 1533 state = (struct inflate_state FAR *)strm->state;
1517 if (check) 1534 if (check)
1518 state->wrap |= 4; 1535 state->wrap |= 4;
@@ -1526,7 +1543,7 @@ z_streamp strm;
1526{ 1543{
1527 struct inflate_state FAR *state; 1544 struct inflate_state FAR *state;
1528 1545
1529 if (strm == Z_NULL || strm->state == Z_NULL) 1546 if (inflateStateCheck(strm))
1530 return -(1L << 16); 1547 return -(1L << 16);
1531 state = (struct inflate_state FAR *)strm->state; 1548 state = (struct inflate_state FAR *)strm->state;
1532 return (long)(((unsigned long)((long)state->back)) << 16) + 1549 return (long)(((unsigned long)((long)state->back)) << 16) +
@@ -1538,7 +1555,7 @@ unsigned long ZEXPORT inflateCodesUsed(strm)
1538z_streamp strm; 1555z_streamp strm;
1539{ 1556{
1540 struct inflate_state FAR *state; 1557 struct inflate_state FAR *state;
1541 if (strm == Z_NULL || strm->state == Z_NULL) return (unsigned long)0 - 1; 1558 if (inflateStateCheck(strm)) return (unsigned long)0 - 1;
1542 state = (struct inflate_state FAR *)strm->state; 1559 state = (struct inflate_state FAR *)strm->state;
1543 return (unsigned long)(state->next - state->codes); 1560 return (unsigned long)(state->next - state->codes);
1544} 1561}