diff options
| author | tjr <tjr@FreeBSD.org> | 2004-08-13 05:38:44 +0000 |
|---|---|---|
| committer | tjr <tjr@FreeBSD.org> | 2004-08-13 05:38:44 +0000 |
| commit | 616ce4ded84267136d3d87c1580e463382fa74b1 (patch) | |
| tree | 82d3a95a16949dca7b66a2dd36f2b53c7067457e /gnu | |
| parent | 1d67228dc0ed0e360fe79fa61ee0e3148ef75c1d (diff) | |
| download | FreeBSD-src-616ce4ded84267136d3d87c1580e463382fa74b1.zip FreeBSD-src-616ce4ded84267136d3d87c1580e463382fa74b1.tar.gz | |
Bring in fix from gzip 1.3.3 to avoid crashes when processing certain corrupt
input files:
1999-06-25 Paul Eggert <eggert@twinsun.com>
* inflate.c (huft_build):
Set n to length of v, to detect improper tables.
Don't accidentally grow j past z.
MFC after: 3 days
Diffstat (limited to 'gnu')
| -rw-r--r-- | gnu/usr.bin/gzip/inflate.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/gnu/usr.bin/gzip/inflate.c b/gnu/usr.bin/gzip/inflate.c index c9b250b..82b1570 100644 --- a/gnu/usr.bin/gzip/inflate.c +++ b/gnu/usr.bin/gzip/inflate.c @@ -360,6 +360,7 @@ int *m; /* maximum lookup bits, returns actual */ if ((j = *p++) != 0) v[x[j]++] = i; } while (++i < n); + n = x[g]; /* set n to length of v */ /* Generate the Huffman codes and for each, make the table entries */ @@ -390,12 +391,13 @@ int *m; /* maximum lookup bits, returns actual */ { /* too few codes for k-w bit table */ f -= a + 1; /* deduct codes from patterns left */ xp = c + k; - while (++j < z) /* try smaller tables up to z bits */ - { - if ((f <<= 1) <= *++xp) - break; /* enough codes to use up j bits */ - f -= *xp; /* else deduct codes from patterns */ - } + if (j < z) + while (++j < z) /* try smaller tables up to z bits */ + { + if ((f <<= 1) <= *++xp) + break; /* enough codes to use up j bits */ + f -= *xp; /* else deduct codes from patterns */ + } } z = 1 << j; /* table entries for j-bit table */ |
