From: dxbjavid <dxbjavid@gmail.com>
Date: Fri, 5 Jun 2026 09:49:42 +0000 (+0530)
Subject: fix integer overflow in gz_buffer_alloc buffer sizing
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=99a21dac8888c06af4bdcd09593e2bfa4586a865;p=thirdparty%2Fzlib-ng.git

fix integer overflow in gz_buffer_alloc buffer sizing
---

diff --git a/gzlib.c b/gzlib.c
index 6794da9d5..6188dfb93 100644
--- a/gzlib.c
+++ b/gzlib.c
@@ -69,8 +69,8 @@ static void gz_reset(gz_state *state) {
 
 /* Allocate in/out buffers for gzFile */
 int Z_INTERNAL gz_buffer_alloc(gz_state *state) {
-    int want = state->want;
-    int in_size = want, out_size = want;
+    size_t want = state->want;
+    size_t in_size = want, out_size = want;
 
     if (state->mode == GZ_WRITE) {
         in_size = want * 2; // double input buffer for compression (ref: gzprintf)
@@ -80,7 +80,15 @@ int Z_INTERNAL gz_buffer_alloc(gz_state *state) {
         out_size = want * 2;  // double output buffer for decompression
     }
 
-    state->buffers = (unsigned char *)zng_alloc_aligned((in_size + out_size), 64);
+    /* the total here reaches 3 * want, but gzbuffer only guarantees 2 * want
+       fits in an unsigned, and zng_alloc_aligned takes an unsigned size; bail
+       out rather than truncate the request into an undersized allocation */
+    if (in_size > UINT_MAX - out_size) {
+        PREFIX(gz_error)(state, Z_MEM_ERROR, "out of memory");
+        return -1;
+    }
+
+    state->buffers = (unsigned char *)zng_alloc_aligned((unsigned)(in_size + out_size), 64);
     state->in = state->buffers;
     if (out_size) {
         state->out = state->buffers + (in_size); // Outbuffer goes after inbuffer