You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
28 lines
941 B
28 lines
941 B
6 years ago
|
From 42a8b8af21af24bb35548bcd2499c792d1a8c1a3 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Richard Hughes <richard@hughsie.com>
|
||
|
|
Date: Wed, 1 Mar 2017 17:15:10 +0000
|
||
|
|
Subject: [PATCH 4/4] Fix buffer overrun when generating Huffman codes
|
||
|
|
|
||
|
|
---
|
||
|
|
libgcab/decomp.c | 4 +++-
|
||
|
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/libgcab/decomp.c b/libgcab/decomp.c
|
||
|
|
index 52445e8..3ee8f9b 100644
|
||
|
|
--- a/libgcab/decomp.c
|
||
|
|
+++ b/libgcab/decomp.c
|
||
|
|
@@ -190,7 +190,9 @@ struct Ziphuft **t, cab_LONG *m, fdi_decomp_state *decomp_state)
|
||
|
|
xp = ZIP(c) + k;
|
||
|
|
while (++j < z) /* try smaller tables up to z bits */
|
||
|
|
{
|
||
|
|
- if ((f <<= 1) <= *++xp)
|
||
|
|
+ if (*++xp > ZIPBMAX)
|
||
|
|
+ return 2; /* corrupt */
|
||
|
|
+ if ((f <<= 1) <= *xp)
|
||
|
|
break; /* enough codes to use up j bits */
|
||
|
|
f -= *xp; /* else deduct codes from patterns */
|
||
|
|
}
|
||
|
|
--
|
||
|
|
2.9.3
|
||
|
|
|