diff options
| author | Theo Buehler <tb@cvs.openbsd.org> | 2022-08-09 07:38:26 +0000 |
|---|---|---|
| committer | Theo Buehler <tb@cvs.openbsd.org> | 2022-08-09 07:38:26 +0000 |
| commit | 4a7e5a4261c51d2d9cd05d30fae97fdfb657a8d4 (patch) | |
| tree | 2bd7296d66df7a2036e0bafa3729b9213960f00c /gnu/usr.bin/perl | |
| parent | a2e9e11b48eb0642aab19f54d54b21e3e006ec1c (diff) | |
Pull in inflateGetHeader() buffer overflow fix
Diffstat (limited to 'gnu/usr.bin/perl')
| -rw-r--r-- | gnu/usr.bin/perl/cpan/Compress-Raw-Zlib/zlib-src/inflate.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/gnu/usr.bin/perl/cpan/Compress-Raw-Zlib/zlib-src/inflate.c b/gnu/usr.bin/perl/cpan/Compress-Raw-Zlib/zlib-src/inflate.c index d5369c275a2..2060956978a 100644 --- a/gnu/usr.bin/perl/cpan/Compress-Raw-Zlib/zlib-src/inflate.c +++ b/gnu/usr.bin/perl/cpan/Compress-Raw-Zlib/zlib-src/inflate.c @@ -761,8 +761,9 @@ int ZEXPORT inflate( if (copy > have) copy = have; if (copy) { if (state->head != Z_NULL && - state->head->extra != Z_NULL) { - len = state->head->extra_len - state->length; + state->head->extra != Z_NULL && + (len = state->head->extra_len - state->length) < + state->head->extra_max) { zmemcpy(state->head->extra + len, next, len + copy > state->head->extra_max ? state->head->extra_max - len : copy); |