diff options
| author | Richard Hughes <richard@hughsie.com> | 2017-03-01 17:15:10 +0000 |
|---|---|---|
| committer | Marc-André Lureau <marcandre.lureau@redhat.com> | 2017-03-03 12:33:09 +0400 |
| commit | 4bc4be192c788c27bd4677a0513deb7c0b7d5083 (patch) | |
| tree | a40e5231a9580251250da63734bf3d9c0a2d7036 | |
| parent | 6190af8dcf10bcb0d3e44f292f0fc806a811bd9e (diff) | |
| download | gcab-4bc4be192c788c27bd4677a0513deb7c0b7d5083.tar.gz | |
Fix buffer overrun when generating Huffman codes
https://bugzilla.gnome.org/show_bug.cgi?id=779462
| -rw-r--r-- | libgcab/decomp.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libgcab/decomp.c b/libgcab/decomp.c index 52445e8..3ee8f9b 100644 --- a/libgcab/decomp.c +++ b/libgcab/decomp.c @@ -190,7 +190,9 @@ struct Ziphuft **t, cab_LONG *m, fdi_decomp_state *decomp_state) xp = ZIP(c) + k; while (++j < z) /* try smaller tables up to z bits */ { - if ((f <<= 1) <= *++xp) + if (*++xp > ZIPBMAX) + return 2; /* corrupt */ + if ((f <<= 1) <= *xp) break; /* enough codes to use up j bits */ f -= *xp; /* else deduct codes from patterns */ } |