From: Nathan Moinvaziri <nathan@nathanm.com>
Date: Wed, 9 Jun 2021 16:15:52 +0000 (+0300)
Subject: [inflate_fast] Always use safe versions of chunkcopy and chunkmemset to avoid errors... 
X-Git-Tag: 2.0.4~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=91599b37e533359a1027d1b6b2be8ed2745145f1;p=thirdparty%2Fzlib-ng.git

[inflate_fast] Always use safe versions of chunkcopy and chunkmemset to avoid errors with optimizations enabled.
---

diff --git a/inffast.c b/inffast.c
index 18ce570e9..c8d3da341 100644
--- a/inffast.c
+++ b/inffast.c
@@ -260,15 +260,11 @@ void Z_INTERNAL zng_inflate_fast(PREFIX3(stream) *strm, unsigned long start) {
                         out = functable.chunkcopy_safe(out, from, len, safe);
                     }
                 } else {
-                    /* Whole reference is in range of current output.  No range checks are
-                       necessary because we start with room for at least 258 bytes of output,
-                       so unroll and roundoff operations can write beyond `out+len` so long
-                       as they stay within 258 bytes of `out`.
-                    */
+                    /* Whole reference is in range of current output. */
                     if (dist >= len || dist >= state->chunksize)
-                        out = functable.chunkcopy(out, out - dist, len);
+                        out = functable.chunkcopy_safe(out, out - dist, len, safe);
                     else
-                        out = functable.chunkmemset(out, dist, len);
+                        out = functable.chunkmemset_safe(out, dist, len, safe - out + 1);
                 }
             } else if ((op & 64) == 0) {          /* 2nd level distance code */
                 here = dcode + here->val + BITS(op);