gzip/patches/gzip-1.3.5-cve-2006-4338.patch

   1 --- gzip-1.3.3/unlzh.c.4338     2006-09-07 10:49:31.000000000 +0200
   2 +++ gzip-1.3.3/unlzh.c  2006-09-07 11:37:53.000000000 +0200
   3 @@ -252,7 +252,7 @@ local void read_c_len()
   4                      if (bitbuf & mask) c = right[c];
   5                      else               c = left [c];
   6                      mask >>= 1;
   7 -                } while (c >= NT);
   8 +                } while (c >= NT && (mask || c != left[c]));
   9              }
  10              fillbuf((int) pt_len[c]);
  11              if (c <= 2) {
  12 @@ -288,7 +288,7 @@ local unsigned decode_c()
  13              if (bitbuf & mask) j = right[j];
  14              else               j = left [j];
  15              mask >>= 1;
  16 -        } while (j >= NC);
  17 +        } while (j >= NC && (mask || j != left[j]));
  18      }
  19      fillbuf((int) c_len[j]);
  20      return j;
  21 @@ -305,7 +305,7 @@ local unsigned decode_p()
  22              if (bitbuf & mask) j = right[j];
  23              else               j = left [j];
  24              mask >>= 1;
  25 -        } while (j >= NP);
  26 +        } while (j >= NP && (mask || j != left[j]));
  27      }
  28      fillbuf((int) pt_len[j]);
  29      if (j != 0) j = ((unsigned) 1 << (j - 1)) + getbits((int) (j - 1));