diff options
| author | Todd C. Miller <millert@cvs.openbsd.org> | 2005-07-06 14:53:45 +0000 |
|---|---|---|
| committer | Todd C. Miller <millert@cvs.openbsd.org> | 2005-07-06 14:53:45 +0000 |
| commit | a3449e523b774a59543e2e1f24254899f743775a (patch) | |
| tree | 330c73cfe81b4a884182fe21fe37a2f7c8184fa7 | |
| parent | 6f23ee77df223bf8150be11d42a0a4b0c3247eb5 (diff) | |
Fix bounds check for incomplete code sets so they cannot overflow the codes
array. From Mark Adler.
| -rw-r--r-- | lib/libz/inftrees.c | 4 | ||||
| -rw-r--r-- | sys/lib/libz/inftrees.c | 4 |
2 files changed, 4 insertions, 4 deletions
diff --git a/lib/libz/inftrees.c b/lib/libz/inftrees.c index 555ee574b5c..5149610e545 100644 --- a/lib/libz/inftrees.c +++ b/lib/libz/inftrees.c @@ -1,4 +1,4 @@ -/* $OpenBSD: inftrees.c,v 1.6 2004/12/03 03:06:36 djm Exp $ */ +/* $OpenBSD: inftrees.c,v 1.7 2005/07/06 14:53:44 millert Exp $ */ /* inftrees.c -- generate Huffman trees for efficient decoding * Copyright (C) 1995-2004 Mark Adler * For conditions of distribution and use, see copyright notice in zlib.h @@ -135,7 +135,7 @@ unsigned short FAR *work; left -= count[len]; if (left < 0) return -1; /* over-subscribed */ } - if (left > 0 && (type == CODES || (codes - count[0] != 1))) + if (left > 0 && (type == CODES || max != 1)) return -1; /* incomplete set */ /* generate offsets into symbol table for each length for sorting */ diff --git a/sys/lib/libz/inftrees.c b/sys/lib/libz/inftrees.c index ba3507df1ba..c906e9103de 100644 --- a/sys/lib/libz/inftrees.c +++ b/sys/lib/libz/inftrees.c @@ -1,4 +1,4 @@ -/* $OpenBSD: inftrees.c,v 1.12 2004/12/03 03:07:09 djm Exp $ */ +/* $OpenBSD: inftrees.c,v 1.13 2005/07/06 14:53:44 millert Exp $ */ /* inftrees.c -- generate Huffman trees for efficient decoding * Copyright (C) 1995-2004 Mark Adler * For conditions of distribution and use, see copyright notice in zlib.h @@ -135,7 +135,7 @@ unsigned short FAR *work; left -= count[len]; if (left < 0) return -1; /* over-subscribed */ } - if (left > 0 && (type == CODES || (codes - count[0] != 1))) + if (left > 0 && (type == CODES || max != 1)) return -1; /* incomplete set */ /* generate offsets into symbol table for each length for sorting */ |