Fix pending buffer overflow assert with LIT_MEM allocation.

Since each element in s->d_buf is 2 bytes, the sx index should be
multiplied by 2 in the assert.

Fixes madler/zlib#897

madler/zlib#ee474ff2d11715485a87b123edbdd615ba218b88

diff --git a/trees.c b/trees.c
index d10f4a49f3a8d6d44c76e92bb44fc223a19f7896..e3e02a487a41f13539d99d5746788cfc652469be 100644 (file)
--- a/trees.c
+++ b/trees.c
@@ -738,7 +738,7 @@ static void compress_block(deflate_state *s, const ct_data *ltree, const ct_data
 
             /* Check for no overlay of pending_buf on needed symbols */
 #ifdef LIT_MEM
-            Assert(s->pending < (s->lit_bufsize << 1) + sx, "pending_buf overflow");
+            Assert(s->pending < 2 * (s->lit_bufsize + sx), "pending_buf overflow");
 #else
             Assert(s->pending < s->lit_bufsize + sx, "pending_buf overflow");
 #endif