@@ -255,11 +255,6 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
255255 int wrap = 1 ;
256256 static const char my_version [] = ZLIB_VERSION ;
257257
258- ushf * overlay ;
259- /* We overlay pending_buf and d_buf+l_buf. This works since the average
260- * output size for (length,distance) codes is <= 24 bits.
261- */
262-
263258 if (version == Z_NULL || version [0 ] != my_version [0 ] ||
264259 stream_size != sizeof (z_stream )) {
265260 return Z_VERSION_ERROR ;
@@ -329,9 +324,47 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
329324
330325 s -> lit_bufsize = 1 << (memLevel + 6 ); /* 16K elements by default */
331326
332- overlay = (ushf * ) ZALLOC (strm , s -> lit_bufsize , sizeof (ush )+ 2 );
333- s -> pending_buf = (uchf * ) overlay ;
334- s -> pending_buf_size = (ulg )s -> lit_bufsize * (sizeof (ush )+ 2L );
327+ /* We overlay pending_buf and sym_buf. This works since the average size
328+ * for length/distance pairs over any compressed block is assured to be 31
329+ * bits or less.
330+ *
331+ * Analysis: The longest fixed codes are a length code of 8 bits plus 5
332+ * extra bits, for lengths 131 to 257. The longest fixed distance codes are
333+ * 5 bits plus 13 extra bits, for distances 16385 to 32768. The longest
334+ * possible fixed-codes length/distance pair is then 31 bits total.
335+ *
336+ * sym_buf starts one-fourth of the way into pending_buf. So there are
337+ * three bytes in sym_buf for every four bytes in pending_buf. Each symbol
338+ * in sym_buf is three bytes -- two for the distance and one for the
339+ * literal/length. As each symbol is consumed, the pointer to the next
340+ * sym_buf value to read moves forward three bytes. From that symbol, up to
341+ * 31 bits are written to pending_buf. The closest the written pending_buf
342+ * bits gets to the next sym_buf symbol to read is just before the last
343+ * code is written. At that time, 31*(n-2) bits have been written, just
344+ * after 24*(n-2) bits have been consumed from sym_buf. sym_buf starts at
345+ * 8*n bits into pending_buf. (Note that the symbol buffer fills when n-1
346+ * symbols are written.) The closest the writing gets to what is unread is
347+ * then n+14 bits. Here n is lit_bufsize, which is 16384 by default, and
348+ * can range from 128 to 32768.
349+ *
350+ * Therefore, at a minimum, there are 142 bits of space between what is
351+ * written and what is read in the overlain buffers, so the symbols cannot
352+ * be overwritten by the compressed data. That space is actually 139 bits,
353+ * due to the three-bit fixed-code block header.
354+ *
355+ * That covers the case where either Z_FIXED is specified, forcing fixed
356+ * codes, or when the use of fixed codes is chosen, because that choice
357+ * results in a smaller compressed block than dynamic codes. That latter
358+ * condition then assures that the above analysis also covers all dynamic
359+ * blocks. A dynamic-code block will only be chosen to be emitted if it has
360+ * fewer bits than a fixed-code block would for the same set of symbols.
361+ * Therefore its average symbol length is assured to be less than 31. So
362+ * the compressed data for a dynamic block also cannot overwrite the
363+ * symbols from which it is being constructed.
364+ */
365+
366+ s -> pending_buf = (uchf * ) ZALLOC (strm , s -> lit_bufsize , 4 );
367+ s -> pending_buf_size = (ulg )s -> lit_bufsize * 4 ;
335368
336369 if (s -> window == Z_NULL || s -> prev == Z_NULL || s -> head == Z_NULL ||
337370 s -> pending_buf == Z_NULL ) {
@@ -340,8 +373,12 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
340373 deflateEnd (strm );
341374 return Z_MEM_ERROR ;
342375 }
343- s -> d_buf = overlay + s -> lit_bufsize /sizeof (ush );
344- s -> l_buf = s -> pending_buf + (1 + sizeof (ush ))* s -> lit_bufsize ;
376+ s -> sym_buf = s -> pending_buf + s -> lit_bufsize ;
377+ s -> sym_end = (s -> lit_bufsize - 1 ) * 3 ;
378+ /* We avoid equality with lit_bufsize*3 because of wraparound at 64K
379+ * on 16 bit machines and because stored blocks are restricted to
380+ * 64K-1 bytes.
381+ */
345382
346383 s -> level = level ;
347384 s -> strategy = strategy ;
@@ -552,7 +589,7 @@ int ZEXPORT deflatePrime (strm, bits, value)
552589
553590 if (deflateStateCheck (strm )) return Z_STREAM_ERROR ;
554591 s = strm -> state ;
555- if (( Bytef * )( s -> d_buf ) < s -> pending_out + ((Buf_size + 7 ) >> 3 ))
592+ if (s -> sym_buf < s -> pending_out + ((Buf_size + 7 ) >> 3 ))
556593 return Z_BUF_ERROR ;
557594 do {
558595 put = Buf_size - s -> bi_valid ;
@@ -1113,7 +1150,6 @@ int ZEXPORT deflateCopy (dest, source)
11131150#else
11141151 deflate_state * ds ;
11151152 deflate_state * ss ;
1116- ushf * overlay ;
11171153
11181154
11191155 if (deflateStateCheck (source ) || dest == Z_NULL ) {
@@ -1133,8 +1169,7 @@ int ZEXPORT deflateCopy (dest, source)
11331169 ds -> window = (Bytef * ) ZALLOC (dest , ds -> w_size , 2 * sizeof (Byte ));
11341170 ds -> prev = (Posf * ) ZALLOC (dest , ds -> w_size , sizeof (Pos ));
11351171 ds -> head = (Posf * ) ZALLOC (dest , ds -> hash_size , sizeof (Pos ));
1136- overlay = (ushf * ) ZALLOC (dest , ds -> lit_bufsize , sizeof (ush )+ 2 );
1137- ds -> pending_buf = (uchf * ) overlay ;
1172+ ds -> pending_buf = (uchf * ) ZALLOC (dest , ds -> lit_bufsize , 4 );
11381173
11391174 if (ds -> window == Z_NULL || ds -> prev == Z_NULL || ds -> head == Z_NULL ||
11401175 ds -> pending_buf == Z_NULL ) {
@@ -1148,8 +1183,7 @@ int ZEXPORT deflateCopy (dest, source)
11481183 zmemcpy (ds -> pending_buf , ss -> pending_buf , (uInt )ds -> pending_buf_size );
11491184
11501185 ds -> pending_out = ds -> pending_buf + (ss -> pending_out - ss -> pending_buf );
1151- ds -> d_buf = overlay + ds -> lit_bufsize /sizeof (ush );
1152- ds -> l_buf = ds -> pending_buf + (1 + sizeof (ush ))* ds -> lit_bufsize ;
1186+ ds -> sym_buf = ds -> pending_buf + ds -> lit_bufsize ;
11531187
11541188 ds -> l_desc .dyn_tree = ds -> dyn_ltree ;
11551189 ds -> d_desc .dyn_tree = ds -> dyn_dtree ;
@@ -1925,7 +1959,7 @@ local block_state deflate_fast(s, flush)
19251959 FLUSH_BLOCK (s , 1 );
19261960 return finish_done ;
19271961 }
1928- if (s -> last_lit )
1962+ if (s -> sym_next )
19291963 FLUSH_BLOCK (s , 0 );
19301964 return block_done ;
19311965}
@@ -2056,7 +2090,7 @@ local block_state deflate_slow(s, flush)
20562090 FLUSH_BLOCK (s , 1 );
20572091 return finish_done ;
20582092 }
2059- if (s -> last_lit )
2093+ if (s -> sym_next )
20602094 FLUSH_BLOCK (s , 0 );
20612095 return block_done ;
20622096}
@@ -2131,7 +2165,7 @@ local block_state deflate_rle(s, flush)
21312165 FLUSH_BLOCK (s , 1 );
21322166 return finish_done ;
21332167 }
2134- if (s -> last_lit )
2168+ if (s -> sym_next )
21352169 FLUSH_BLOCK (s , 0 );
21362170 return block_done ;
21372171}
@@ -2170,7 +2204,7 @@ local block_state deflate_huff(s, flush)
21702204 FLUSH_BLOCK (s , 1 );
21712205 return finish_done ;
21722206 }
2173- if (s -> last_lit )
2207+ if (s -> sym_next )
21742208 FLUSH_BLOCK (s , 0 );
21752209 return block_done ;
21762210}
0 commit comments