xfnw/plan9fox
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

libflate: add bounds checking on decode array, add sanity checks in hufftab()

Browse source
This commit is contained in:
cinap_lenrek 2016-08-15 01:07:28 +02:00
parent 75a8003a8a
commit 5af0a7ce73
1 changed files with 11 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
sys/src/libflate/inflate.c
View file

@ -48,6 +48,7 @@ struct Huff
ulong maxcode[MaxHuffBits];
ulong last[MaxHuffBits];
ulong decode[MaxLeaf];
int maxleaf;
};
/* litlen code words 257-285 extra bits */
@ -565,14 +566,16 @@ hufftab(Huff *h, char *hb, int maxleaf, int flatbits)
maxbits = b;
}
}
h->maxbits = maxbits;
if(maxbits <= 0){
h->maxbits = 0;
h->minbits = 0;
h->flatmask = 0;
h->maxleaf = 0;
return 1;
}
h->maxbits = maxbits;
if(maxbits >= MaxHuffBits || minbits <= 0)
return 0;
code = 0;
c = 0;
for(b = 0; b <= maxbits; b++){
@ -613,6 +616,7 @@ hufftab(Huff *h, char *hb, int maxleaf, int flatbits)
h->flat[revcode(mincode, flatbits)] = (b << 8) | 0xff;
}
h->maxleaf = maxleaf;
for(i = 0; i < maxleaf; i++){
b = hb[i];
if(b <= 0)
@ -639,7 +643,7 @@ hufftab(Huff *h, char *hb, int maxleaf, int flatbits)
static int
hdecsym(Input *in, Huff *h, int nb)
{
long c;
ulong c;
if((nb & 0xff) == 0xff)
nb = nb >> 8;
@ -652,9 +656,12 @@ hdecsym(Input *in, Huff *h, int nb)
c |= revtab[(in->sreg>>8)&0xff];
c >>= (16-nb);
if(c <= h->maxcode[nb]){
c = h->last[nb] - c;
if(c >= h->maxleaf)
break;
in->sreg >>= nb;
in->nbits -= nb;
return h->decode[h->last[nb] - c];
return h->decode[c];
}
}
in->error = FlateCorrupted;