]>
Commit | Line | Data |
---|---|---|
fda2b22e AM |
1 | >From 6a043145ca6e9c55184013841a67b2fef87e44c0 Mon Sep 17 00:00:00 2001 |
2 | From: Mark Adler <madler@alumni.caltech.edu> | |
3 | Date: Wed, 21 Sep 2016 23:35:50 -0700 | |
4 | Subject: [PATCH] Remove offset pointer optimization in inftrees.c. | |
5 | ||
6 | inftrees.c was subtracting an offset from a pointer to an array, | |
7 | in order to provide a pointer that allowed indexing starting at | |
8 | the offset. This is not compliant with the C standard, for which | |
9 | the behavior of a pointer decremented before its allocated memory | |
10 | is undefined. Per the recommendation of a security audit of the | |
11 | zlib code by Trail of Bits and TrustInSoft, in support of the | |
12 | Mozilla Foundation, this tiny optimization was removed, in order | |
13 | to avoid the possibility of undefined behavior. | |
14 | --- | |
15 | inftrees.c | 18 ++++++++---------- | |
16 | 1 file changed, 8 insertions(+), 10 deletions(-) | |
17 | ||
18 | diff --git a/zlib/inftrees.c b/zlib/inftrees.c | |
19 | index 22fcd666..0d2670d5 100644 | |
20 | --- a/zlib/inftrees.c | |
21 | +++ b/zlib/inftrees.c | |
22 | @@ -54,7 +54,7 @@ unsigned short FAR *work; | |
23 | code FAR *next; /* next available space in table */ | |
24 | const unsigned short FAR *base; /* base value table to use */ | |
25 | const unsigned short FAR *extra; /* extra bits table to use */ | |
26 | - int end; /* use base and extra for symbol > end */ | |
27 | + unsigned match; /* use base and extra for symbol >= match */ | |
28 | unsigned short count[MAXBITS+1]; /* number of codes of each length */ | |
29 | unsigned short offs[MAXBITS+1]; /* offsets in table for each length */ | |
30 | static const unsigned short lbase[31] = { /* Length codes 257..285 base */ | |
31 | @@ -181,19 +181,17 @@ unsigned short FAR *work; | |
32 | switch (type) { | |
33 | case CODES: | |
34 | base = extra = work; /* dummy value--not used */ | |
35 | - end = 19; | |
36 | + match = 20; | |
37 | break; | |
38 | case LENS: | |
39 | base = lbase; | |
40 | - base -= 257; | |
41 | extra = lext; | |
42 | - extra -= 257; | |
43 | - end = 256; | |
44 | + match = 257; | |
45 | break; | |
46 | default: /* DISTS */ | |
47 | base = dbase; | |
48 | extra = dext; | |
49 | - end = -1; | |
50 | + match = 0; | |
51 | } | |
52 | ||
53 | /* initialize state for loop */ | |
54 | @@ -216,13 +214,13 @@ unsigned short FAR *work; | |
55 | for (;;) { | |
56 | /* create table entry */ | |
57 | here.bits = (unsigned char)(len - drop); | |
58 | - if ((int)(work[sym]) < end) { | |
59 | + if (work[sym] + 1 < match) { | |
60 | here.op = (unsigned char)0; | |
61 | here.val = work[sym]; | |
62 | } | |
63 | - else if ((int)(work[sym]) > end) { | |
64 | - here.op = (unsigned char)(extra[work[sym]]); | |
65 | - here.val = base[work[sym]]; | |
66 | + else if (work[sym] >= match) { | |
67 | + here.op = (unsigned char)(extra[work[sym] - match]); | |
68 | + here.val = base[work[sym] - match]; | |
69 | } | |
70 | else { | |
71 | here.op = (unsigned char)(32 + 64); /* end of block */ |