diff options
author | Mark Adler <madler@alumni.caltech.edu> | 2016-10-24 20:11:41 -0700 |
---|---|---|
committer | Mark Adler <madler@alumni.caltech.edu> | 2016-10-24 21:07:43 -0700 |
commit | b516b4bdd7c0c9f0858adfebf732089014f7b282 (patch) | |
tree | fcee291aca78e7bf475e0060e42f18a40174c947 /inflate.c | |
parent | 77fd7e56bfc75b4194145060bb1ec5256ce077c6 (diff) | |
download | zlib-b516b4bdd7c0c9f0858adfebf732089014f7b282.tar.gz zlib-b516b4bdd7c0c9f0858adfebf732089014f7b282.tar.bz2 zlib-b516b4bdd7c0c9f0858adfebf732089014f7b282.zip |
Do a more thorough check of the state for every stream call.
This verifies that the state has been initialized, that it is the
expected type of state, deflate or inflate, and that at least the
first several bytes of the internal state have not been clobbered.
Diffstat (limited to 'inflate.c')
-rw-r--r-- | inflate.c | 51 |
1 files changed, 34 insertions, 17 deletions
@@ -92,6 +92,7 @@ | |||
92 | #endif | 92 | #endif |
93 | 93 | ||
94 | /* function prototypes */ | 94 | /* function prototypes */ |
95 | local int inflateStateCheck OF((z_streamp strm)); | ||
95 | local void fixedtables OF((struct inflate_state FAR *state)); | 96 | local void fixedtables OF((struct inflate_state FAR *state)); |
96 | local int updatewindow OF((z_streamp strm, const unsigned char FAR *end, | 97 | local int updatewindow OF((z_streamp strm, const unsigned char FAR *end, |
97 | unsigned copy)); | 98 | unsigned copy)); |
@@ -101,12 +102,26 @@ local int updatewindow OF((z_streamp strm, const unsigned char FAR *end, | |||
101 | local unsigned syncsearch OF((unsigned FAR *have, const unsigned char FAR *buf, | 102 | local unsigned syncsearch OF((unsigned FAR *have, const unsigned char FAR *buf, |
102 | unsigned len)); | 103 | unsigned len)); |
103 | 104 | ||
105 | local int inflateStateCheck(strm) | ||
106 | z_streamp strm; | ||
107 | { | ||
108 | struct inflate_state FAR *state; | ||
109 | if (strm == Z_NULL || | ||
110 | strm->zalloc == (alloc_func)0 || strm->zfree == (free_func)0) | ||
111 | return 1; | ||
112 | state = (struct inflate_state FAR *)strm->state; | ||
113 | if (state == Z_NULL || state->strm != strm || | ||
114 | state->mode < HEAD || state->mode > SYNC) | ||
115 | return 1; | ||
116 | return 0; | ||
117 | } | ||
118 | |||
104 | int ZEXPORT inflateResetKeep(strm) | 119 | int ZEXPORT inflateResetKeep(strm) |
105 | z_streamp strm; | 120 | z_streamp strm; |
106 | { | 121 | { |
107 | struct inflate_state FAR *state; | 122 | struct inflate_state FAR *state; |
108 | 123 | ||
109 | if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; | 124 | if (inflateStateCheck(strm)) return Z_STREAM_ERROR; |
110 | state = (struct inflate_state FAR *)strm->state; | 125 | state = (struct inflate_state FAR *)strm->state; |
111 | strm->total_in = strm->total_out = state->total = 0; | 126 | strm->total_in = strm->total_out = state->total = 0; |
112 | strm->msg = Z_NULL; | 127 | strm->msg = Z_NULL; |
@@ -131,7 +146,7 @@ z_streamp strm; | |||
131 | { | 146 | { |
132 | struct inflate_state FAR *state; | 147 | struct inflate_state FAR *state; |
133 | 148 | ||
134 | if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; | 149 | if (inflateStateCheck(strm)) return Z_STREAM_ERROR; |
135 | state = (struct inflate_state FAR *)strm->state; | 150 | state = (struct inflate_state FAR *)strm->state; |
136 | state->wsize = 0; | 151 | state->wsize = 0; |
137 | state->whave = 0; | 152 | state->whave = 0; |
@@ -147,7 +162,7 @@ int windowBits; | |||
147 | struct inflate_state FAR *state; | 162 | struct inflate_state FAR *state; |
148 | 163 | ||
149 | /* get the state */ | 164 | /* get the state */ |
150 | if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; | 165 | if (inflateStateCheck(strm)) return Z_STREAM_ERROR; |
151 | state = (struct inflate_state FAR *)strm->state; | 166 | state = (struct inflate_state FAR *)strm->state; |
152 | 167 | ||
153 | /* extract wrap request from windowBits parameter */ | 168 | /* extract wrap request from windowBits parameter */ |
@@ -210,7 +225,9 @@ int stream_size; | |||
210 | if (state == Z_NULL) return Z_MEM_ERROR; | 225 | if (state == Z_NULL) return Z_MEM_ERROR; |
211 | Tracev((stderr, "inflate: allocated\n")); | 226 | Tracev((stderr, "inflate: allocated\n")); |
212 | strm->state = (struct internal_state FAR *)state; | 227 | strm->state = (struct internal_state FAR *)state; |
228 | state->strm = strm; | ||
213 | state->window = Z_NULL; | 229 | state->window = Z_NULL; |
230 | state->mode = HEAD; /* to pass state test in inflateReset2() */ | ||
214 | ret = inflateReset2(strm, windowBits); | 231 | ret = inflateReset2(strm, windowBits); |
215 | if (ret != Z_OK) { | 232 | if (ret != Z_OK) { |
216 | ZFREE(strm, state); | 233 | ZFREE(strm, state); |
@@ -234,7 +251,7 @@ int value; | |||
234 | { | 251 | { |
235 | struct inflate_state FAR *state; | 252 | struct inflate_state FAR *state; |
236 | 253 | ||
237 | if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; | 254 | if (inflateStateCheck(strm)) return Z_STREAM_ERROR; |
238 | state = (struct inflate_state FAR *)strm->state; | 255 | state = (struct inflate_state FAR *)strm->state; |
239 | if (bits < 0) { | 256 | if (bits < 0) { |
240 | state->hold = 0; | 257 | state->hold = 0; |
@@ -625,7 +642,7 @@ int flush; | |||
625 | static const unsigned short order[19] = /* permutation of code lengths */ | 642 | static const unsigned short order[19] = /* permutation of code lengths */ |
626 | {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15}; | 643 | {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15}; |
627 | 644 | ||
628 | if (strm == Z_NULL || strm->state == Z_NULL || strm->next_out == Z_NULL || | 645 | if (inflateStateCheck(strm) || strm->next_out == Z_NULL || |
629 | (strm->next_in == Z_NULL && strm->avail_in != 0)) | 646 | (strm->next_in == Z_NULL && strm->avail_in != 0)) |
630 | return Z_STREAM_ERROR; | 647 | return Z_STREAM_ERROR; |
631 | 648 | ||
@@ -1261,7 +1278,7 @@ int ZEXPORT inflateEnd(strm) | |||
1261 | z_streamp strm; | 1278 | z_streamp strm; |
1262 | { | 1279 | { |
1263 | struct inflate_state FAR *state; | 1280 | struct inflate_state FAR *state; |
1264 | if (strm == Z_NULL || strm->state == Z_NULL || strm->zfree == (free_func)0) | 1281 | if (inflateStateCheck(strm)) |
1265 | return Z_STREAM_ERROR; | 1282 | return Z_STREAM_ERROR; |
1266 | state = (struct inflate_state FAR *)strm->state; | 1283 | state = (struct inflate_state FAR *)strm->state; |
1267 | if (state->window != Z_NULL) ZFREE(strm, state->window); | 1284 | if (state->window != Z_NULL) ZFREE(strm, state->window); |
@@ -1279,7 +1296,7 @@ uInt *dictLength; | |||
1279 | struct inflate_state FAR *state; | 1296 | struct inflate_state FAR *state; |
1280 | 1297 | ||
1281 | /* check state */ | 1298 | /* check state */ |
1282 | if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; | 1299 | if (inflateStateCheck(strm)) return Z_STREAM_ERROR; |
1283 | state = (struct inflate_state FAR *)strm->state; | 1300 | state = (struct inflate_state FAR *)strm->state; |
1284 | 1301 | ||
1285 | /* copy dictionary */ | 1302 | /* copy dictionary */ |
@@ -1304,7 +1321,7 @@ uInt dictLength; | |||
1304 | int ret; | 1321 | int ret; |
1305 | 1322 | ||
1306 | /* check state */ | 1323 | /* check state */ |
1307 | if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; | 1324 | if (inflateStateCheck(strm)) return Z_STREAM_ERROR; |
1308 | state = (struct inflate_state FAR *)strm->state; | 1325 | state = (struct inflate_state FAR *)strm->state; |
1309 | if (state->wrap != 0 && state->mode != DICT) | 1326 | if (state->wrap != 0 && state->mode != DICT) |
1310 | return Z_STREAM_ERROR; | 1327 | return Z_STREAM_ERROR; |
@@ -1336,7 +1353,7 @@ gz_headerp head; | |||
1336 | struct inflate_state FAR *state; | 1353 | struct inflate_state FAR *state; |
1337 | 1354 | ||
1338 | /* check state */ | 1355 | /* check state */ |
1339 | if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; | 1356 | if (inflateStateCheck(strm)) return Z_STREAM_ERROR; |
1340 | state = (struct inflate_state FAR *)strm->state; | 1357 | state = (struct inflate_state FAR *)strm->state; |
1341 | if ((state->wrap & 2) == 0) return Z_STREAM_ERROR; | 1358 | if ((state->wrap & 2) == 0) return Z_STREAM_ERROR; |
1342 | 1359 | ||
@@ -1389,7 +1406,7 @@ z_streamp strm; | |||
1389 | struct inflate_state FAR *state; | 1406 | struct inflate_state FAR *state; |
1390 | 1407 | ||
1391 | /* check parameters */ | 1408 | /* check parameters */ |
1392 | if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; | 1409 | if (inflateStateCheck(strm)) return Z_STREAM_ERROR; |
1393 | state = (struct inflate_state FAR *)strm->state; | 1410 | state = (struct inflate_state FAR *)strm->state; |
1394 | if (strm->avail_in == 0 && state->bits < 8) return Z_BUF_ERROR; | 1411 | if (strm->avail_in == 0 && state->bits < 8) return Z_BUF_ERROR; |
1395 | 1412 | ||
@@ -1436,7 +1453,7 @@ z_streamp strm; | |||
1436 | { | 1453 | { |
1437 | struct inflate_state FAR *state; | 1454 | struct inflate_state FAR *state; |
1438 | 1455 | ||
1439 | if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; | 1456 | if (inflateStateCheck(strm)) return Z_STREAM_ERROR; |
1440 | state = (struct inflate_state FAR *)strm->state; | 1457 | state = (struct inflate_state FAR *)strm->state; |
1441 | return state->mode == STORED && state->bits == 0; | 1458 | return state->mode == STORED && state->bits == 0; |
1442 | } | 1459 | } |
@@ -1451,8 +1468,7 @@ z_streamp source; | |||
1451 | unsigned wsize; | 1468 | unsigned wsize; |
1452 | 1469 | ||
1453 | /* check input */ | 1470 | /* check input */ |
1454 | if (dest == Z_NULL || source == Z_NULL || source->state == Z_NULL || | 1471 | if (inflateStateCheck(source) || dest == Z_NULL) |
1455 | source->zalloc == (alloc_func)0 || source->zfree == (free_func)0) | ||
1456 | return Z_STREAM_ERROR; | 1472 | return Z_STREAM_ERROR; |
1457 | state = (struct inflate_state FAR *)source->state; | 1473 | state = (struct inflate_state FAR *)source->state; |
1458 | 1474 | ||
@@ -1473,6 +1489,7 @@ z_streamp source; | |||
1473 | /* copy state */ | 1489 | /* copy state */ |
1474 | zmemcpy((voidpf)dest, (voidpf)source, sizeof(z_stream)); | 1490 | zmemcpy((voidpf)dest, (voidpf)source, sizeof(z_stream)); |
1475 | zmemcpy((voidpf)copy, (voidpf)state, sizeof(struct inflate_state)); | 1491 | zmemcpy((voidpf)copy, (voidpf)state, sizeof(struct inflate_state)); |
1492 | copy->strm = dest; | ||
1476 | if (state->lencode >= state->codes && | 1493 | if (state->lencode >= state->codes && |
1477 | state->lencode <= state->codes + ENOUGH - 1) { | 1494 | state->lencode <= state->codes + ENOUGH - 1) { |
1478 | copy->lencode = copy->codes + (state->lencode - state->codes); | 1495 | copy->lencode = copy->codes + (state->lencode - state->codes); |
@@ -1494,7 +1511,7 @@ int subvert; | |||
1494 | { | 1511 | { |
1495 | struct inflate_state FAR *state; | 1512 | struct inflate_state FAR *state; |
1496 | 1513 | ||
1497 | if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; | 1514 | if (inflateStateCheck(strm)) return Z_STREAM_ERROR; |
1498 | state = (struct inflate_state FAR *)strm->state; | 1515 | state = (struct inflate_state FAR *)strm->state; |
1499 | #ifdef INFLATE_ALLOW_INVALID_DISTANCE_TOOFAR_ARRR | 1516 | #ifdef INFLATE_ALLOW_INVALID_DISTANCE_TOOFAR_ARRR |
1500 | state->sane = !subvert; | 1517 | state->sane = !subvert; |
@@ -1512,7 +1529,7 @@ int check; | |||
1512 | { | 1529 | { |
1513 | struct inflate_state FAR *state; | 1530 | struct inflate_state FAR *state; |
1514 | 1531 | ||
1515 | if (strm == Z_NULL || strm->state == Z_NULL) return Z_STREAM_ERROR; | 1532 | if (inflateStateCheck(strm)) return Z_STREAM_ERROR; |
1516 | state = (struct inflate_state FAR *)strm->state; | 1533 | state = (struct inflate_state FAR *)strm->state; |
1517 | if (check) | 1534 | if (check) |
1518 | state->wrap |= 4; | 1535 | state->wrap |= 4; |
@@ -1526,7 +1543,7 @@ z_streamp strm; | |||
1526 | { | 1543 | { |
1527 | struct inflate_state FAR *state; | 1544 | struct inflate_state FAR *state; |
1528 | 1545 | ||
1529 | if (strm == Z_NULL || strm->state == Z_NULL) | 1546 | if (inflateStateCheck(strm)) |
1530 | return -(1L << 16); | 1547 | return -(1L << 16); |
1531 | state = (struct inflate_state FAR *)strm->state; | 1548 | state = (struct inflate_state FAR *)strm->state; |
1532 | return (long)(((unsigned long)((long)state->back)) << 16) + | 1549 | return (long)(((unsigned long)((long)state->back)) << 16) + |
@@ -1538,7 +1555,7 @@ unsigned long ZEXPORT inflateCodesUsed(strm) | |||
1538 | z_streamp strm; | 1555 | z_streamp strm; |
1539 | { | 1556 | { |
1540 | struct inflate_state FAR *state; | 1557 | struct inflate_state FAR *state; |
1541 | if (strm == Z_NULL || strm->state == Z_NULL) return (unsigned long)0 - 1; | 1558 | if (inflateStateCheck(strm)) return (unsigned long)0 - 1; |
1542 | state = (struct inflate_state FAR *)strm->state; | 1559 | state = (struct inflate_state FAR *)strm->state; |
1543 | return (unsigned long)(state->next - state->codes); | 1560 | return (unsigned long)(state->next - state->codes); |
1544 | } | 1561 | } |