b8b43e
From eff308af425b67093bab25f80f1ae950166bece1 Mon Sep 17 00:00:00 2001
b8b43e
From: Mark Adler <fork@madler.net>
b8b43e
Date: Sat, 30 Jul 2022 15:51:11 -0700
b8b43e
Subject: [PATCH] Fix a bug when getting a gzip header extra field with
b8b43e
 inflate().
b8b43e
b8b43e
If the extra field was larger than the space the user provided with
b8b43e
inflateGetHeader(), and if multiple calls of inflate() delivered
b8b43e
the extra header data, then there could be a buffer overflow of the
b8b43e
provided space. This commit assures that provided space is not
b8b43e
exceeded.
b8b43e
---
b8b43e
 inflate.c | 5 +++--
b8b43e
 1 file changed, 3 insertions(+), 2 deletions(-)
b8b43e
b8b43e
diff --git a/inflate.c b/inflate.c
b8b43e
index 7be8c63..7a72897 100644
b8b43e
--- a/inflate.c
b8b43e
+++ b/inflate.c
b8b43e
@@ -763,9 +763,10 @@ int flush;
b8b43e
                 copy = state->length;
b8b43e
                 if (copy > have) copy = have;
b8b43e
                 if (copy) {
b8b43e
+                    len = state->head->extra_len - state->length;
b8b43e
                     if (state->head != Z_NULL &&
b8b43e
-                        state->head->extra != Z_NULL) {
b8b43e
-                        len = state->head->extra_len - state->length;
b8b43e
+                        state->head->extra != Z_NULL &&
b8b43e
+                        len < state->head->extra_max) {
b8b43e
                         zmemcpy(state->head->extra + len, next,
b8b43e
                                 len + copy > state->head->extra_max ?
b8b43e
                                 state->head->extra_max - len : copy);
b8b43e
-- 
b8b43e
2.35.3
b8b43e