Skip to content

Commit

Permalink
Make sure inflateCopy() allocates window with the necessary buffer fo…
Browse files Browse the repository at this point in the history
…r chunked operations.

Based on Chromium bugfix https://chromium-review.googlesource.com/c/chromium/src/+/4876445
  • Loading branch information
Dead2 committed Sep 27, 2023
1 parent 57a2ed9 commit 0ec1c6d
Showing 1 changed file with 10 additions and 14 deletions.
24 changes: 10 additions & 14 deletions inflate.c
Original file line number Diff line number Diff line change
Expand Up @@ -1319,8 +1319,6 @@ int32_t Z_EXPORT PREFIX(inflateSyncPoint)(PREFIX3(stream) *strm) {
int32_t Z_EXPORT PREFIX(inflateCopy)(PREFIX3(stream) *dest, PREFIX3(stream) *source) {
struct inflate_state *state;
struct inflate_state *copy;
unsigned char *window;
unsigned wsize;

/* check input */
if (inflateStateCheck(source) || dest == NULL)
Expand All @@ -1331,15 +1329,6 @@ int32_t Z_EXPORT PREFIX(inflateCopy)(PREFIX3(stream) *dest, PREFIX3(stream) *sou
copy = ZALLOC_INFLATE_STATE(source);
if (copy == NULL)
return Z_MEM_ERROR;
window = NULL;
if (state->window != NULL) {
wsize = 1U << state->wbits;
window = (unsigned char *)ZALLOC_WINDOW(source, wsize, sizeof(unsigned char));
if (window == NULL) {
ZFREE_STATE(source, copy);
return Z_MEM_ERROR;
}
}

/* copy state */
memcpy((void *)dest, (void *)source, sizeof(PREFIX3(stream)));
Expand All @@ -1350,10 +1339,17 @@ int32_t Z_EXPORT PREFIX(inflateCopy)(PREFIX3(stream) *dest, PREFIX3(stream) *sou
copy->distcode = copy->codes + (state->distcode - state->codes);
}
copy->next = copy->codes + (state->next - state->codes);
if (window != NULL) {
ZCOPY_WINDOW(window, state->window, (size_t)1U << state->wbits);

/* window */
if (state->window != NULL)
copy->window = NULL;
if (PREFIX(inflate_ensure_window)(copy)) {
ZFREE_STATE(source, copy);
return Z_MEM_ERROR;
}
ZCOPY_WINDOW(copy->window, state->window, (size_t)state->wsize);
}
copy->window = window;

dest->state = (struct internal_state *)copy;
return Z_OK;
}
Expand Down

0 comments on commit 0ec1c6d

Please sign in to comment.