]> git.ipfire.org Git - thirdparty/zlib-ng.git/commit
fix oss-fuzz/13863
authorSebastian Pop <s.pop@samsung.com>
Tue, 26 Mar 2019 16:59:45 +0000 (11:59 -0500)
committerHans Kristian Rosbach <hk-github@circlestorm.org>
Wed, 27 Mar 2019 11:59:13 +0000 (12:59 +0100)
commitd62321622a3bbff0633a55f6525d8d64887a0bb7
tree19535f65da212445d864c39f59be0173f2bb5f18
parentbac13dc2c80434636c716c204e83a88319d6ce95
fix oss-fuzz/13863

The oss fuzzers started failing with the following assert
```
ASSERT: 0 == memcmp(data + offset, buf, len)
```
after the following patch has been pulled in the tree:

```
commit 20ca64fa5d2d8a7421ed86b68709ef971dcfbddf
Author: Sebastian Pop <s.pop@samsung.com>
Date:   Wed Mar 6 14:16:20 2019 -0600

    define and use chunkmemset instead of byte_memset for INFFAST_CHUNKSIZE
```

The function chunkcopysafe is assuming that the input `len` is less than 16 bytes:
```
    if ((safe - out) < (ptrdiff_t)INFFAST_CHUNKSIZE) {
```
but we were called with `len = 22` because `safe` was defined too small:

```
-    safe = out + (strm->avail_out - INFFAST_CHUNKSIZE);
```
and the difference `safe - out` was 16 bytes smaller than the actual `len`.
The patch fixes the initialization of `safe` to:
```
+    safe = out + strm->avail_out;
```
inffast.c