gzip/gzip-1.3.5-cve-2006-4336.patch
2006-09-20 10:52:34 +00:00

21 lines
813 B
Diff

--- gzip-1.3.3/unpack.c.4336 1999-10-06 07:00:00.000000000 +0200
+++ gzip-1.3.3/unpack.c 2006-09-07 10:49:08.000000000 +0200
@@ -133,7 +133,7 @@
/* Remember where the literals of this length start in literal[] : */
lit_base[len] = base;
/* And read the literals: */
- for (n = leaves[len]; n > 0; n--) {
+ for (n = leaves[len]; n > 0 && base < LITERALS; n--) {
literal[base++] = (uch)get_byte();
}
}
@@ -169,7 +169,7 @@
prefixp = &prefix_len[1<<peek_bits];
for (len = 1; len <= peek_bits; len++) {
int prefixes = leaves[len] << (peek_bits-len); /* may be 0 */
- while (prefixes--) *--prefixp = (uch)len;
+ while (prefixes-- && prefixp > prefix_len) *--prefixp = (uch)len;
}
/* The length of all other codes is unknown: */
while (prefixp > prefix_len) *--prefixp = 0;