17 lines
493 B
Diff
17 lines
493 B
Diff
|
* unlzw.c (unlzw): Avoid integer overflow.
|
||
|
|
Aki Helin reported the segfault along with an input to trigger the bug.
|
||
|
|
Index: gzip-1.3.13/unlzw.c
|
||
|
|
===================================================================
|
||
|
|
--- gzip-1.3.13.orig/unlzw.c
|
||
|
|
+++ gzip-1.3.13/unlzw.c
|
||
|
|
@@ -244,7 +244,8 @@ int unlzw(in, out)
|
||
|
|
int o;
|
||
|
|
|
||
|
|
resetbuf:
|
||
|
|
- e = insize-(o = (posbits>>3));
|
||
|
|
+ o = posbits >> 3;
|
||
|
|
+ e = o <= insize ? insize - o : 0;
|
||
|
|
|
||
|
|
for (i = 0 ; i < e ; ++i) {
|
||
|
|
inbuf[i] = inbuf[i+o];
|