Skip to content
Snippets Groups Projects
  1. Apr 20, 2018
    • Mark Adler's avatar
    • Mark Adler's avatar
      Fix a bug that can crash deflate on some input when using Z_FIXED. · 5c44459c
      Mark Adler authored
      This bug was reported by Danilo Ramos of Eideticom, Inc. It has
      lain in wait 13 years before being found! The bug was introduced
      in zlib 1.2.2.2, with the addition of the Z_FIXED option. That
      option forces the use of fixed Huffman codes. For rare inputs with
      a large number of distant matches, the pending buffer into which
      the compressed data is written can overwrite the distance symbol
      table which it overlays. That results in corrupted output due to
      invalid distances, and can result in out-of-bound accesses,
      crashing the application.
      
      The fix here combines the distance buffer and literal/length
      buffers into a single symbol buffer. Now three bytes of pending
      buffer space are opened up for each literal or length/distance
      pair consumed, instead of the previous two bytes. This assures
      that the pending buffer cannot overwrite the symbol table, since
      the maximum fixed code compressed length/distance is 31 bits, and
      since there are four bytes of pending space for every three bytes
      of symbol space.
      5c44459c
  2. Jan 31, 2018
  3. Jan 09, 2018
  4. Oct 13, 2017
  5. Jun 03, 2017
    • Mark Adler's avatar
      Avoid the use of ptrdiff_t. · 3c46f5dd
      Mark Adler authored
      This isn't the right type anyway to assure that it contains a
      pointer. That type would be intptr_t or uintptr_t. However the C99
      standard says that those types are optional, so their use would not
      be portable. This commit simply uses size_t or whatever configure
      decided to use for size_t. That would be the same length as
      ptrdiff_t, and so will work just as well. The code checks to see if
      the length of the type used is the same as the length of a void
      pointer, so there is already protection against the use of the
      wrong type. The use of size_t (or ptrdiff_t) will almost always
      work, as all modern architectures have an array size that is the
      same as the pointer size. Only old segmented architectures would
      have to fall back to the slower CRC-32 calculation, where the
      amount of memory that can be accessed is larger than the maximum
      array size.
      3c46f5dd
  6. Apr 16, 2017
    • Mark Adler's avatar
      Handle case where inflateSync used when header never processed. · 44e8ac81
      Mark Adler authored
      If zlib and/or gzip header processing was requested, but a header
      was never provided and inflateSync was used successfully, then the
      inflate state would be inconsistent, trying to compute a check
      value but with no flags set. This commit sets the inflate mode to
      raw in this case, since there is no other assumption that can be
      made if a header was requested but never seen.
      44e8ac81
  7. Mar 30, 2017
  8. Feb 19, 2017
  9. Feb 16, 2017
  10. Jan 16, 2017
  11. Jan 15, 2017
  12. Jan 03, 2017
Loading