aboutsummaryrefslogtreecommitdiff
path: root/inftrees.c
diff options
context:
space:
mode:
authorMark Adler <madler@alumni.caltech.edu>2016-09-21 23:35:50 -0700
committerMark Adler <madler@alumni.caltech.edu>2016-09-21 23:35:50 -0700
commit6a043145ca6e9c55184013841a67b2fef87e44c0 (patch)
tree521ea23934f8280e71ad581d5028d9f045424c9e /inftrees.c
parent9aaec95e82117c1cb0f9624264c3618fc380cecb (diff)
downloadzlib-6a043145ca6e9c55184013841a67b2fef87e44c0.tar.gz
zlib-6a043145ca6e9c55184013841a67b2fef87e44c0.tar.bz2
zlib-6a043145ca6e9c55184013841a67b2fef87e44c0.zip
Remove offset pointer optimization in inftrees.c.
inftrees.c was subtracting an offset from a pointer to an array, in order to provide a pointer that allowed indexing starting at the offset. This is not compliant with the C standard, for which the behavior of a pointer decremented before its allocated memory is undefined. Per the recommendation of a security audit of the zlib code by Trail of Bits and TrustInSoft, in support of the Mozilla Foundation, this tiny optimization was removed, in order to avoid the possibility of undefined behavior.
Diffstat (limited to 'inftrees.c')
-rw-r--r--inftrees.c18
1 files changed, 8 insertions, 10 deletions
diff --git a/inftrees.c b/inftrees.c
index 22fcd66..0d2670d 100644
--- a/inftrees.c
+++ b/inftrees.c
@@ -54,7 +54,7 @@ unsigned short FAR *work;
54 code FAR *next; /* next available space in table */ 54 code FAR *next; /* next available space in table */
55 const unsigned short FAR *base; /* base value table to use */ 55 const unsigned short FAR *base; /* base value table to use */
56 const unsigned short FAR *extra; /* extra bits table to use */ 56 const unsigned short FAR *extra; /* extra bits table to use */
57 int end; /* use base and extra for symbol > end */ 57 unsigned match; /* use base and extra for symbol >= match */
58 unsigned short count[MAXBITS+1]; /* number of codes of each length */ 58 unsigned short count[MAXBITS+1]; /* number of codes of each length */
59 unsigned short offs[MAXBITS+1]; /* offsets in table for each length */ 59 unsigned short offs[MAXBITS+1]; /* offsets in table for each length */
60 static const unsigned short lbase[31] = { /* Length codes 257..285 base */ 60 static const unsigned short lbase[31] = { /* Length codes 257..285 base */
@@ -181,19 +181,17 @@ unsigned short FAR *work;
181 switch (type) { 181 switch (type) {
182 case CODES: 182 case CODES:
183 base = extra = work; /* dummy value--not used */ 183 base = extra = work; /* dummy value--not used */
184 end = 19; 184 match = 20;
185 break; 185 break;
186 case LENS: 186 case LENS:
187 base = lbase; 187 base = lbase;
188 base -= 257;
189 extra = lext; 188 extra = lext;
190 extra -= 257; 189 match = 257;
191 end = 256;
192 break; 190 break;
193 default: /* DISTS */ 191 default: /* DISTS */
194 base = dbase; 192 base = dbase;
195 extra = dext; 193 extra = dext;
196 end = -1; 194 match = 0;
197 } 195 }
198 196
199 /* initialize state for loop */ 197 /* initialize state for loop */
@@ -216,13 +214,13 @@ unsigned short FAR *work;
216 for (;;) { 214 for (;;) {
217 /* create table entry */ 215 /* create table entry */
218 here.bits = (unsigned char)(len - drop); 216 here.bits = (unsigned char)(len - drop);
219 if ((int)(work[sym]) < end) { 217 if (work[sym] + 1 < match) {
220 here.op = (unsigned char)0; 218 here.op = (unsigned char)0;
221 here.val = work[sym]; 219 here.val = work[sym];
222 } 220 }
223 else if ((int)(work[sym]) > end) { 221 else if (work[sym] >= match) {
224 here.op = (unsigned char)(extra[work[sym]]); 222 here.op = (unsigned char)(extra[work[sym] - match]);
225 here.val = base[work[sym]]; 223 here.val = base[work[sym] - match];
226 } 224 }
227 else { 225 else {
228 here.op = (unsigned char)(32 + 64); /* end of block */ 226 here.op = (unsigned char)(32 + 64); /* end of block */