Assure that the number of bits for deflatePrime() is valid.

diff --git a/deflate.c b/deflate.c
index b408ee8e3e5408c2cd0bf53915667424e7cbdba3..bdf6f21109512396fd3d26bdf4d1bb299ede7956 100644 (file)
--- a/deflate.c
+++ b/deflate.c
@@ -553,7 +553,8 @@ int ZEXPORT PREFIX(deflatePrime)(PREFIX3(stream) *strm, int bits, int value) {
     if (deflateStateCheck(strm))
         return Z_STREAM_ERROR;
     s = strm->state;
-    if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
+    if (bits < 0 || bits > 16 ||
+        s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
         return Z_BUF_ERROR;
     do {
         put = Buf_size - s->bi_valid;