gzip/gzip-1.3.5-cve-2006-4338.patch

--- gzip-1.3.3/unlzh.c.4338	2006-09-07 10:49:31.000000000 +0200
+++ gzip-1.3.3/unlzh.c	2006-09-07 11:37:53.000000000 +0200
@@ -252,7 +252,7 @@ local void read_c_len()
                     if (bitbuf & mask) c = right[c];
                     else               c = left [c];
                     mask >>= 1;
-                } while (c >= NT);
+                } while (c >= NT && (mask || c != left[c]));
             }
             fillbuf((int) pt_len[c]);
             if (c <= 2) {
@@ -288,7 +288,7 @@ local unsigned decode_c()
             if (bitbuf & mask) j = right[j];
             else               j = left [j];
             mask >>= 1;
-        } while (j >= NC);
+        } while (j >= NC && (mask || j != left[j])); 
     }
     fillbuf((int) c_len[j]);
     return j;
@@ -305,7 +305,7 @@ local unsigned decode_p()
             if (bitbuf & mask) j = right[j];
             else               j = left [j];
             mask >>= 1;
-        } while (j >= NP);
+        } while (j >= NP && (mask || j != left[j]));
     }
     fillbuf((int) pt_len[j]);
     if (j != 0) j = ((unsigned) 1 << (j - 1)) + getbits((int) (j - 1));