Skip to content

[zlib] Fix potential vulnerable cloned functions #18526

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[zlib] Fix potential vulnerable cloned functions #18526

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
81 changes: 31 additions & 50 deletions builtins/zlib/inffast.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,25 +10,6 @@

#ifndef ASMINF

/* Allow machine dependent optimization for post-increment or pre-increment.
Based on testing to date,
Pre-increment preferred for:
- PowerPC G3 (Adler)
- MIPS R5000 (Randers-Pehrson)
Post-increment preferred for:
- none
No measurable difference:
- Pentium III (Anderson)
- M68060 (Nikl)
*/
#ifdef POSTINC
# define OFF 0
# define PUP(a) *(a)++
#else
# define OFF 1
# define PUP(a) *++(a)
#endif

/*
Decode literal, length, and distance codes and write out the resulting
literal and match bytes until either not enough input or output is
Expand Down Expand Up @@ -94,9 +75,9 @@ void ZLIB_INTERNAL inflate_fast(z_streamp strm, unsigned start) /* infla

/* copy state to local variables */
state = (struct inflate_state FAR *)strm->state;
in = strm->next_in - OFF;
in = strm->next_in;
last = in + (strm->avail_in - 5);
out = strm->next_out - OFF;
out = strm->next_out;
beg = out - (start - strm->avail_out);
end = out + (strm->avail_out - 257);
#ifdef INFLATE_STRICT
Expand All @@ -117,9 +98,9 @@ void ZLIB_INTERNAL inflate_fast(z_streamp strm, unsigned start) /* infla
input data or output space */
do {
if (bits < 15) {
hold += (unsigned long)(PUP(in)) << bits;
hold += (unsigned long)(*in++) << bits;
bits += 8;
hold += (unsigned long)(PUP(in)) << bits;
hold += (unsigned long)(*in++) << bits;
bits += 8;
}
here = lcode[hold & lmask];
Expand All @@ -132,14 +113,14 @@ void ZLIB_INTERNAL inflate_fast(z_streamp strm, unsigned start) /* infla
Tracevv((stderr, here.val >= 0x20 && here.val < 0x7f ?
"inflate: literal '%c'\n" :
"inflate: literal 0x%02x\n", here.val));
PUP(out) = (unsigned char)(here.val);
*out++ = (unsigned char)(here.val);
}
else if (op & 16) { /* length base */
len = (unsigned)(here.val);
op &= 15; /* number of extra bits */
if (op) {
if (bits < op) {
hold += (unsigned long)(PUP(in)) << bits;
hold += (unsigned long)(*in++) << bits;
bits += 8;
}
len += (unsigned)hold & ((1U << op) - 1);
Expand All @@ -148,9 +129,9 @@ void ZLIB_INTERNAL inflate_fast(z_streamp strm, unsigned start) /* infla
}
Tracevv((stderr, "inflate: length %u\n", len));
if (bits < 15) {
hold += (unsigned long)(PUP(in)) << bits;
hold += (unsigned long)(*in++) << bits;
bits += 8;
hold += (unsigned long)(PUP(in)) << bits;
hold += (unsigned long)(*in++) << bits;
bits += 8;
}
here = dcode[hold & dmask];
Expand All @@ -163,10 +144,10 @@ void ZLIB_INTERNAL inflate_fast(z_streamp strm, unsigned start) /* infla
dist = (unsigned)(here.val);
op &= 15; /* number of extra bits */
if (bits < op) {
hold += (unsigned long)(PUP(in)) << bits;
hold += (unsigned long)(*in++) << bits;
bits += 8;
if (bits < op) {
hold += (unsigned long)(PUP(in)) << bits;
hold += (unsigned long)(*in++) << bits;
bits += 8;
}
}
Expand Down Expand Up @@ -194,30 +175,30 @@ void ZLIB_INTERNAL inflate_fast(z_streamp strm, unsigned start) /* infla
#ifdef INFLATE_ALLOW_INVALID_DISTANCE_TOOFAR_ARRR
if (len <= op - whave) {
do {
PUP(out) = 0;
*out++ = 0;
} while (--len);
continue;
}
len -= op - whave;
do {
PUP(out) = 0;
*out++ = 0;
} while (--op > whave);
if (op == 0) {
from = out - dist;
do {
PUP(out) = PUP(from);
*out++ = *from++;
} while (--len);
continue;
}
#endif
}
from = window - OFF;
from = window;
if (wnext == 0) { /* very common case */
from += wsize - op;
if (op < len) { /* some from window */
len -= op;
do {
PUP(out) = PUP(from);
*out++ = *from++;
} while (--op);
from = out - dist; /* rest from output */
}
Expand All @@ -228,14 +209,14 @@ void ZLIB_INTERNAL inflate_fast(z_streamp strm, unsigned start) /* infla
if (op < len) { /* some from end of window */
len -= op;
do {
PUP(out) = PUP(from);
*out++ = *from++;
} while (--op);
from = window - OFF;
from = window;
if (wnext < len) { /* some from start of window */
op = wnext;
len -= op;
do {
PUP(out) = PUP(from);
*out++ = *from++;
} while (--op);
from = out - dist; /* rest from output */
}
Expand All @@ -246,35 +227,35 @@ void ZLIB_INTERNAL inflate_fast(z_streamp strm, unsigned start) /* infla
if (op < len) { /* some from window */
len -= op;
do {
PUP(out) = PUP(from);
*out++ = *from++;
} while (--op);
from = out - dist; /* rest from output */
}
}
while (len > 2) {
PUP(out) = PUP(from);
PUP(out) = PUP(from);
PUP(out) = PUP(from);
*out++ = *from++;
*out++ = *from++;
*out++ = *from++;
len -= 3;
}
if (len) {
PUP(out) = PUP(from);
*out++ = *from++;
if (len > 1)
PUP(out) = PUP(from);
*out++ = *from++;
}
}
else {
from = out - dist; /* copy direct from output */
do { /* minimum length is three */
PUP(out) = PUP(from);
PUP(out) = PUP(from);
PUP(out) = PUP(from);
*out++ = *from++;
*out++ = *from++;
*out++ = *from++;
len -= 3;
} while (len > 2);
if (len) {
PUP(out) = PUP(from);
*out++ = *from++;
if (len > 1)
PUP(out) = PUP(from);
*out++ = *from++;
}
}
}
Expand Down Expand Up @@ -311,8 +292,8 @@ void ZLIB_INTERNAL inflate_fast(z_streamp strm, unsigned start) /* infla
hold &= (1U << bits) - 1;

/* update state and return */
strm->next_in = in + OFF;
strm->next_out = out + OFF;
strm->next_in = in;
strm->next_out = out;
strm->avail_in = (unsigned)(in < last ? 5 + (last - in) : 5 - (in - last));
strm->avail_out = (unsigned)(out < end ?
257 + (end - out) : 257 - (out - end));
Expand Down
Loading