summaryrefslogtreecommitdiff
path: root/zlib.h
diff options
context:
space:
mode:
authorMark Adler <madler@alumni.caltech.edu>2013-02-18 21:06:35 -0800
committerMark Adler <madler@alumni.caltech.edu>2013-02-18 21:47:00 -0800
commit51370f365607fe14a6a7a1a27b3bd29d788f5e5b (patch)
tree09db363475af028a7b9157b949667491d132f6de /zlib.h
parent10056909c00bca2684340856ce20272f3fd8fa43 (diff)
downloadzlib-51370f365607fe14a6a7a1a27b3bd29d788f5e5b.tar.gz
Fix serious but very rare decompression bug in inftrees.c.
inftrees.c compared the number of used table entries to the maximum allowed value using >= instead of >. This patch fixes those to use >. The bug was discovered by Ignat Kolesnichenko of Yandex LC where they have run petabytes of data through zlib. Triggering the bug is apparently very rare, seeing as how it has been out there in the wild for almost three years before being discovered. The bug is instantiated only if the exact maximum number of decoding table entries, ENOUGH_DISTS or ENOUGH_LENS is used by the block being decoded, resulting in the false positive of overflowing the table.
Diffstat (limited to 'zlib.h')
0 files changed, 0 insertions, 0 deletions