tinflate: When using sliding dictionary, check that offset lies within it.

This commit is contained in:
Paul Sokolovsky 2016-10-11 07:08:28 +03:00
parent 3fb1f4f7d8
commit 27176508e1
2 changed files with 4 additions and 0 deletions

View file

@ -32,6 +32,7 @@ extern "C" {
#define TINF_DONE 1
#define TINF_DATA_ERROR (-3)
#define TINF_CHKSUM_ERROR (-4)
#define TINF_DICT_ERROR (-5)
/* checksum types */
#define TINF_CHKSUM_NONE 0

View file

@ -361,6 +361,9 @@ static int tinf_inflate_block_data(TINF_DATA *d, TINF_TREE *lt, TINF_TREE *dt)
/* possibly get more bits from distance code */
offs = tinf_read_bits(d, dist_bits[dist], dist_base[dist]);
if (d->dict_ring) {
if (offs > d->dict_size) {
return TINF_DICT_ERROR;
}
d->lzOff = d->dict_idx - offs;
if (d->lzOff < 0) {
d->lzOff += d->dict_size;