From: Mark Adler <madler@alumni.caltech.edu>
Date: Wed, 18 Apr 2018 05:44:41 +0000 (-0700)
Subject: Assure that the number of bits for deflatePrime() is valid.
X-Git-Tag: 1.9.9-b1~584
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2d683ceba8a4af73afa26527e19f095d5c5fe1e6;p=thirdparty%2Fzlib-ng.git

Assure that the number of bits for deflatePrime() is valid.
---

diff --git a/deflate.c b/deflate.c
index b408ee8e3..bdf6f2110 100644
--- a/deflate.c
+++ b/deflate.c
@@ -553,7 +553,8 @@ int ZEXPORT PREFIX(deflatePrime)(PREFIX3(stream) *strm, int bits, int value) {
     if (deflateStateCheck(strm))
         return Z_STREAM_ERROR;
     s = strm->state;
-    if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
+    if (bits < 0 || bits > 16 ||
+        s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
         return Z_BUF_ERROR;
     do {
         put = Buf_size - s->bi_valid;