Blame SOURCES/gzip-1.3.13-cve-2006-4337.patch

c9760d
--- gzip-1.3.9/unlzh.c.4337	2007-01-15 16:31:53.000000000 +0100
c9760d
+++ gzip-1.3.9/unlzh.c	2007-01-15 16:38:08.000000000 +0100
c9760d
@@ -146,8 +146,8 @@
c9760d
     start[1] = 0;
c9760d
     for (i = 1; i <= 16; i++)
c9760d
         start[i + 1] = start[i] + (count[i] << (16 - i));
c9760d
-    if ((start[17] & 0xffff) != 0)
c9760d
-      gzip_error ("Bad table\n");
c9760d
+   if ((start[17] & 0xffff) != 0 || tablebits > 16) /* 16 for weight below */
c9760d
+      gzip_error ("Bad table (case b)\n"); 
c9760d
 
c9760d
     jutbits = 16 - tablebits;
c9760d
     for (i = 1; i <= (unsigned)tablebits; i++) {
c9760d
@@ -161,15 +162,15 @@
c9760d
 
c9760d
     i = start[tablebits + 1] >> jutbits;
c9760d
     if (i != 0) {
c9760d
-        k = 1 << tablebits;
c9760d
-        while (i != k) table[i++] = 0;
c9760d
+        k = MIN(1 << tablebits, DIST_BUFSIZE);
c9760d
+        while (i < k) table[i++] = 0;
c9760d
     }
c9760d
 
c9760d
     avail = nchar;
c9760d
     mask = (unsigned) 1 << (15 - tablebits);
c9760d
     for (ch = 0; ch < (unsigned)nchar; ch++) {
c9760d
         if ((len = bitlen[ch]) == 0) continue;
c9760d
-        nextcode = start[len] + weight[len];
c9760d
+        nextcode = MIN(start[len] + weight[len], DIST_BUFSIZE);
c9760d
         if (len <= (unsigned)tablebits) {
c9760d
             if ((unsigned) 1 << tablebits < nextcode)
c9760d
               gzip_error ("Bad table\n");
c9760d
@@ -212,7 +213,7 @@
c9760d
         for (i = 0; i < 256; i++) pt_table[i] = c;
c9760d
     } else {
c9760d
         i = 0;
c9760d
-        while (i < n) {
c9760d
+        while (i < MIN(n,NPT)) {
c9760d
             c = bitbuf >> (BITBUFSIZ - 3);
c9760d
             if (c == 7) {
c9760d
                 mask = (unsigned) 1 << (BITBUFSIZ - 1 - 3);
c9760d
@@ -224,7 +225,7 @@
c9760d
             pt_len[i++] = c;
c9760d
             if (i == i_special) {
c9760d
                 c = getbits(2);
c9760d
-                while (--c >= 0) pt_len[i++] = 0;
c9760d
+                while (--c >= 0 && i < NPT) pt_len[i++] = 0; 
c9760d
             }
c9760d
         }
c9760d
         while (i < nn) pt_len[i++] = 0;
c9760d
@@ -244,7 +245,7 @@
c9760d
         for (i = 0; i < 4096; i++) c_table[i] = c;
c9760d
     } else {
c9760d
         i = 0;
c9760d
-        while (i < n) {
c9760d
+        while (i < MIN(n,NC)) { 
c9760d
             c = pt_table[bitbuf >> (BITBUFSIZ - 8)];
c9760d
             if (c >= NT) {
c9760d
                 mask = (unsigned) 1 << (BITBUFSIZ - 1 - 8);
c9760d
@@ -259,7 +260,7 @@
c9760d
                 if      (c == 0) c = 1;
c9760d
                 else if (c == 1) c = getbits(4) + 3;
c9760d
                 else             c = getbits(CBIT) + 20;
c9760d
-                while (--c >= 0) c_len[i++] = 0;
c9760d
+                while (--c >= 0 && i < NC) c_len[i++] = 0; 
c9760d
             } else c_len[i++] = c - 2;
c9760d
         }
c9760d
         while (i < NC) c_len[i++] = 0;
c9760d
@@ -352,7 +353,7 @@
c9760d
     while (--j >= 0) {
c9760d
         buffer[r] = buffer[i];
c9760d
         i = (i + 1) & (DICSIZ - 1);
c9760d
-        if (++r == count) return r;
c9760d
+        if (++r >= count) return r;
c9760d
     }
c9760d
     for ( ; ; ) {
c9760d
         c = decode_c();
c9760d
@@ -362,14 +363,14 @@
c9760d
         }
c9760d
         if (c <= UCHAR_MAX) {
c9760d
             buffer[r] = c;
c9760d
-            if (++r == count) return r;
c9760d
+            if (++r >= count) return r;
c9760d
         } else {
c9760d
             j = c - (UCHAR_MAX + 1 - THRESHOLD);
c9760d
             i = (r - decode_p() - 1) & (DICSIZ - 1);
c9760d
             while (--j >= 0) {
c9760d
                 buffer[r] = buffer[i];
c9760d
                 i = (i + 1) & (DICSIZ - 1);
c9760d
-                if (++r == count) return r;
c9760d
+                if (++r >= count) return r;
c9760d
             }
c9760d
         }
c9760d
     }
c9760d
--- gzip-1.3.9/gzip.h.4337	2007-01-15 16:31:53.000000000 +0100
c9760d
+++ gzip-1.3.9/gzip.h	2007-01-15 16:38:52.000000000 +0100
c9760d
@@ -224,6 +224,8 @@
c9760d
 #define get_byte()  (inptr < insize ? inbuf[inptr++] : fill_inbuf(0))
c9760d
 #define try_byte()  (inptr < insize ? inbuf[inptr++] : fill_inbuf(1))
c9760d
 
c9760d
+#define MIN(a,b) ((a) <= (b) ? (a) : (b)) 
c9760d
+
c9760d
 /* put_byte is used for the compressed output, put_ubyte for the
c9760d
  * uncompressed output. However unlzw() uses window for its
c9760d
  * suffix table instead of its output buffer, so it does not use put_ubyte
c9760d
--- gzip-1.3.9/unpack.c.4337	2007-01-15 16:31:53.000000000 +0100
c9760d
+++ gzip-1.3.9/unpack.c	2007-01-15 16:39:12.000000000 +0100
c9760d
@@ -21,9 +21,6 @@
c9760d
 #include "tailor.h"
c9760d
 #include "gzip.h"
c9760d
 
c9760d
-#define MIN(a,b) ((a) <= (b) ? (a) : (b))
c9760d
-/* The arguments must not have side effects. */
c9760d
-
c9760d
 #define MAX_BITLEN 25
c9760d
 /* Maximum length of Huffman codes. (Minor modifications to the code
c9760d
  * would be needed to support 32 bits codes, but pack never generates
c9760d