diff options
author | Mark Adler <fork@madler.net> | 2022-08-08 10:50:09 -0700 |
---|---|---|
committer | Mark Adler <fork@madler.net> | 2022-08-08 10:55:40 -0700 |
commit | 1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d (patch) | |
tree | 0cae0ba8c95ca16ecc218abd39aa119bc40690c8 | |
parent | 22aec0cb0bb53c126f9feb0471f616203e55d37d (diff) | |
download | zlib-1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d.tar.gz |
Fix extra field processing bug that dereferences NULL state->head.
The recent commit to fix a gzip header extra field processing bug
introduced the new bug fixed here.
-rw-r--r-- | inflate.c | 4 |
1 files changed, 2 insertions, 2 deletions
@@ -763,10 +763,10 @@ int flush; copy = state->length; if (copy > have) copy = have; if (copy) { - len = state->head->extra_len - state->length; if (state->head != Z_NULL && state->head->extra != Z_NULL && - len < state->head->extra_max) { + (len = state->head->extra_len - state->length) < + state->head->extra_max) { zmemcpy(state->head->extra + len, next, len + copy > state->head->extra_max ? state->head->extra_max - len : copy); |