cnd / rpms / gzip

Forked from rpms/gzip 3 years ago
Clone

Blame SOURCES/gzip-1.3.5-cve-2006-4338.patch

f408d8
--- gzip-1.3.3/unlzh.c.4338	2006-09-07 10:49:31.000000000 +0200
f408d8
+++ gzip-1.3.3/unlzh.c	2006-09-07 11:37:53.000000000 +0200
f408d8
@@ -252,7 +252,7 @@ local void read_c_len()
f408d8
                     if (bitbuf & mask) c = right[c];
f408d8
                     else               c = left [c];
f408d8
                     mask >>= 1;
f408d8
-                } while (c >= NT);
f408d8
+                } while (c >= NT && (mask || c != left[c]));
f408d8
             }
f408d8
             fillbuf((int) pt_len[c]);
f408d8
             if (c <= 2) {
f408d8
@@ -288,7 +288,7 @@ local unsigned decode_c()
f408d8
             if (bitbuf & mask) j = right[j];
f408d8
             else               j = left [j];
f408d8
             mask >>= 1;
f408d8
-        } while (j >= NC);
f408d8
+        } while (j >= NC && (mask || j != left[j])); 
f408d8
     }
f408d8
     fillbuf((int) c_len[j]);
f408d8
     return j;
f408d8
@@ -305,7 +305,7 @@ local unsigned decode_p()
f408d8
             if (bitbuf & mask) j = right[j];
f408d8
             else               j = left [j];
f408d8
             mask >>= 1;
f408d8
-        } while (j >= NP);
f408d8
+        } while (j >= NP && (mask || j != left[j]));
f408d8
     }
f408d8
     fillbuf((int) pt_len[j]);
f408d8
     if (j != 0) j = ((unsigned) 1 << (j - 1)) + getbits((int) (j - 1));