Fix out-of-bound access of zng_length_codes.

diff --git a/deflate_quick.c b/deflate_quick.c
index d616677c5f9138c826c2b78a56bde2c90a4509bb..df5a17b9e6623c556ae8c05665e708ea7da70fa6 100644 (file)
--- a/deflate_quick.c
+++ b/deflate_quick.c
@@ -99,6 +99,8 @@ Z_INTERNAL block_state deflate_quick(deflate_state *s, int flush) {
                     if (match_len >= WANT_MIN_MATCH) {
                         if (UNLIKELY(match_len > s->lookahead))
                             match_len = s->lookahead;
+                        if (UNLIKELY(match_len > STD_MAX_MATCH))
+                            match_len = STD_MAX_MATCH;
 
                         check_match(s, s->strstart, hash_head, match_len);
 

diff --git a/deflate_rle.c b/deflate_rle.c
index 77df71f585b44327911507477f01e42c8c431aa7..4e3fde09f0a188d0a80bf584aaa29fd4195e26a6 100644 (file)
--- a/deflate_rle.c
+++ b/deflate_rle.c
@@ -47,6 +47,7 @@ Z_INTERNAL block_state deflate_rle(deflate_state *s, int flush) {
                          scan < strend);
                 match_len = STD_MAX_MATCH - (unsigned int)(strend - scan);
                 match_len = MIN(match_len, s->lookahead);
+                match_len = MIN(match_len, STD_MAX_MATCH);
             }
             Assert(scan <= s->window + s->window_size - 1, "wild scan");
         }