@@ -137,6 +137,7 @@ static INLINE BOOL zgfx_GetBits(ZGFX_CONTEXT* _zgfx, UINT32 _nbits)
137137 _zgfx -> cBitsCurrent -= _nbits ;
138138 _zgfx -> bits = _zgfx -> BitsCurrent >> _zgfx -> cBitsCurrent ;
139139 _zgfx -> BitsCurrent &= ((1 << _zgfx -> cBitsCurrent ) - 1 );
140+ return TRUE;
140141}
141142
142143static void zgfx_history_buffer_ring_write (ZGFX_CONTEXT * zgfx , const BYTE * src , size_t count )
@@ -229,9 +230,15 @@ static BOOL zgfx_decompress_segment(ZGFX_CONTEXT* zgfx, wStream* stream, size_t
229230 UINT32 count ;
230231 UINT32 distance ;
231232 BYTE * pbSegment ;
232- size_t cbSegment = segmentSize - 1 ;
233+ size_t cbSegment ;
233234
234- if ((Stream_GetRemainingLength (stream ) < segmentSize ) || (segmentSize < 1 ))
235+ if (!zgfx || !stream )
236+ return FALSE;
237+
238+ cbSegment = segmentSize - 1 ;
239+
240+ if ((Stream_GetRemainingLength (stream ) < segmentSize ) || (segmentSize < 1 ) ||
241+ (segmentSize > UINT32_MAX ))
235242 return FALSE;
236243
237244 Stream_Read_UINT8 (stream , flags ); /* header (1 byte) */
@@ -242,6 +249,10 @@ static BOOL zgfx_decompress_segment(ZGFX_CONTEXT* zgfx, wStream* stream, size_t
242249 if (!(flags & PACKET_COMPRESSED ))
243250 {
244251 zgfx_history_buffer_ring_write (zgfx , pbSegment , cbSegment );
252+
253+ if (cbSegment > sizeof (zgfx -> OutputBuffer ))
254+ return FALSE;
255+
245256 CopyMemory (zgfx -> OutputBuffer , pbSegment , cbSegment );
246257 zgfx -> OutputCount = cbSegment ;
247258 return TRUE;
@@ -280,6 +291,9 @@ static BOOL zgfx_decompress_segment(ZGFX_CONTEXT* zgfx, wStream* stream, size_t
280291 if (++ zgfx -> HistoryIndex == zgfx -> HistoryBufferSize )
281292 zgfx -> HistoryIndex = 0 ;
282293
294+ if (zgfx -> OutputCount >= sizeof (zgfx -> OutputBuffer ))
295+ return FALSE;
296+
283297 zgfx -> OutputBuffer [zgfx -> OutputCount ++ ] = c ;
284298 }
285299 else
@@ -313,6 +327,9 @@ static BOOL zgfx_decompress_segment(ZGFX_CONTEXT* zgfx, wStream* stream, size_t
313327 count += zgfx -> bits ;
314328 }
315329
330+ if (count > sizeof (zgfx -> OutputBuffer ) - zgfx -> OutputCount )
331+ return FALSE;
332+
316333 zgfx_history_buffer_ring_read (zgfx , distance , & (zgfx -> OutputBuffer [zgfx -> OutputCount ]), count );
317334 zgfx_history_buffer_ring_write (zgfx , & (zgfx -> OutputBuffer [zgfx -> OutputCount ]), count );
318335 zgfx -> OutputCount += count ;
@@ -325,6 +342,10 @@ static BOOL zgfx_decompress_segment(ZGFX_CONTEXT* zgfx, wStream* stream, size_t
325342 zgfx -> cBitsRemaining -= zgfx -> cBitsCurrent ;
326343 zgfx -> cBitsCurrent = 0 ;
327344 zgfx -> BitsCurrent = 0 ;
345+
346+ if (count > sizeof (zgfx -> OutputBuffer ) - zgfx -> OutputCount )
347+ return FALSE;
348+
328349 CopyMemory (& (zgfx -> OutputBuffer [zgfx -> OutputCount ]), zgfx -> pbInputCurrent , count );
329350 zgfx_history_buffer_ring_write (zgfx , zgfx -> pbInputCurrent , count );
330351 zgfx -> pbInputCurrent += count ;
0 commit comments