length of v, to detect improper tables" and "Don't accidentally grow j
past z". The return 2 instead of the return 0 is so that we actually
error out if we also get inproper tables (for some reason the code
returned "OK" in such cases).
Fix outstanding security bugs in the Linux zlib implementations. See:
a) http://sources.redhat.com/ml/bug-gnu-utils/1999-06/msg00183.html
b) http://bugs.gentoo.org/show_bug.cgi?id=94584
Signed-off-by: Tim Yamin <plasmaroo@gentoo.org>
Signed-off-by: Tavis Ormandy <taviso@gentoo.org>
{
*t = (inflate_huft *)Z_NULL;
*m = 0;
{
*t = (inflate_huft *)Z_NULL;
*m = 0;
if ((j = *p++) != 0)
v[x[j]++] = i;
} while (++i < n);
if ((j = *p++) != 0)
v[x[j]++] = i;
} while (++i < n);
+ n = x[g]; /* set n to length of v */
/* Generate the Huffman codes and for each, make the table entries */
/* Generate the Huffman codes and for each, make the table entries */
{
*t = (inflate_huft *)Z_NULL;
*m = 0;
{
*t = (inflate_huft *)Z_NULL;
*m = 0;
if ((j = *p++) != 0)
v[x[j]++] = i;
} while (++i < n);
if ((j = *p++) != 0)
v[x[j]++] = i;
} while (++i < n);
+ n = x[g]; /* set n to length of v */
/* Generate the Huffman codes and for each, make the table entries */
/* Generate the Huffman codes and for each, make the table entries */
{
*t = (struct huft *)NULL;
*m = 0;
{
*t = (struct huft *)NULL;
*m = 0;
if ((j = *p++) != 0)
v[x[j]++] = i;
} while (++i < n);
if ((j = *p++) != 0)
v[x[j]++] = i;
} while (++i < n);
+ n = x[g]; /* set n to length of v */
DEBG1("2 ");
f -= a + 1; /* deduct codes from patterns left */
xp = c + k;
DEBG1("2 ");
f -= a + 1; /* deduct codes from patterns left */
xp = c + k;
- while (++j < z) /* try smaller tables up to z bits */
- {
- if ((f <<= 1) <= *++xp)
- break; /* enough codes to use up j bits */
- f -= *xp; /* else deduct codes from patterns */
- }
+ if (j < z)
+ while (++j < z) /* try smaller tables up to z bits */
+ {
+ if ((f <<= 1) <= *++xp)
+ break; /* enough codes to use up j bits */
+ f -= *xp; /* else deduct codes from patterns */
+ }
}
DEBG1("3 ");
z = 1 << j; /* table entries for j-bit table */
}
DEBG1("3 ");
z = 1 << j; /* table entries for j-bit table */
{
*t = (inflate_huft *)Z_NULL;
*m = 0;
{
*t = (inflate_huft *)Z_NULL;
*m = 0;