From: Nathan Moinvaziri <nathan@nathanm.com>
Date: Mon, 1 Jun 2020 04:46:03 +0000 (-0700)
Subject: Fixed arithmetic overflow when emitting deflate header bits.
X-Git-Tag: 1.9.9-b1~237
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1b054601f9f01d872a05f22635e714ae11996b9e;p=thirdparty%2Fzlib-ng.git

Fixed arithmetic overflow when emitting deflate header bits.

    Arithmetic overflow: 32-bit value is shifted, then cast to 64-bit value.
      Results might not be an expected value.
---

diff --git a/trees_emit.h b/trees_emit.h
index efc4a71b..30613f70 100644
--- a/trees_emit.h
+++ b/trees_emit.h
@@ -196,7 +196,8 @@ static inline void zng_tr_emit_dist(deflate_state *s, const ct_data *ltree, cons
 static inline void zng_tr_emit_tree(deflate_state *s, int type, const int last) {
     uint32_t bi_valid = s->bi_valid;
     uint64_t bi_buf = s->bi_buf;
-    send_bits(s, (type << 1) + last, 3, bi_buf, bi_valid);
+    uint32_t header_bits = (type << 1) + last;
+    send_bits(s, header_bits, 3, bi_buf, bi_valid);
     cmpr_bits_add(s, 3);
     s->bi_valid = bi_valid;
     s->bi_buf = bi_buf;