arrfab / rpms / zlib

Forked from rpms/zlib 5 years ago
Clone

Blame SOURCES/zlib-1.2.7-fix-serious-but-very-rare-decompression-bug-in-inftr.patch

e149ac
From 51370f365607fe14a6a7a1a27b3bd29d788f5e5b Mon Sep 17 00:00:00 2001
e149ac
From: Mark Adler <madler@alumni.caltech.edu>
e149ac
Date: Mon, 18 Feb 2013 21:06:35 -0800
e149ac
Subject: [PATCH] Fix serious but very rare decompression bug in inftrees.c.
e149ac
e149ac
inftrees.c compared the number of used table entries to the maximum
e149ac
allowed value using >= instead of >.  This patch fixes those to use
e149ac
>.  The bug was discovered by Ignat Kolesnichenko of Yandex LC
e149ac
where they have run petabytes of data through zlib.  Triggering the
e149ac
bug is apparently very rare, seeing as how it has been out there in
e149ac
the wild for almost three years before being discovered.  The bug
e149ac
is instantiated only if the exact maximum number of decoding table
e149ac
entries, ENOUGH_DISTS or ENOUGH_LENS is used by the block being
e149ac
decoded, resulting in the false positive of overflowing the table.
e149ac
---
e149ac
 inftrees.c | 8 ++++----
e149ac
 1 file changed, 4 insertions(+), 4 deletions(-)
e149ac
e149ac
diff --git a/inftrees.c b/inftrees.c
e149ac
index 873da59..3781399 100644
e149ac
--- a/inftrees.c
e149ac
+++ b/inftrees.c
e149ac
@@ -208,8 +208,8 @@ unsigned short FAR *work;
e149ac
     mask = used - 1;            /* mask for comparing low */
e149ac
 
e149ac
     /* check available table space */
e149ac
-    if ((type == LENS && used >= ENOUGH_LENS) ||
e149ac
-        (type == DISTS && used >= ENOUGH_DISTS))
e149ac
+    if ((type == LENS && used > ENOUGH_LENS) ||
e149ac
+        (type == DISTS && used > ENOUGH_DISTS))
e149ac
         return 1;
e149ac
 
e149ac
     /* process all codes and make table entries */
e149ac
@@ -277,8 +277,8 @@ unsigned short FAR *work;
e149ac
 
e149ac
             /* check for enough space */
e149ac
             used += 1U << curr;
e149ac
-            if ((type == LENS && used >= ENOUGH_LENS) ||
e149ac
-                (type == DISTS && used >= ENOUGH_DISTS))
e149ac
+            if ((type == LENS && used > ENOUGH_LENS) ||
e149ac
+                (type == DISTS && used > ENOUGH_DISTS))
e149ac
                 return 1;
e149ac
 
e149ac
             /* point entry in root table to sub-table */
e149ac
-- 
e149ac
1.9.3
e149ac