From: Mika Lindqvist <postmaster@raasu.org>
Date: Wed, 9 Jun 2021 16:15:12 +0000 (+0300)
Subject: [CHUNKCOPY_SAFE] Fix off-by-one error
X-Git-Tag: 2.0.4~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ce4409c1241a60c7ba5807530adf4a795ff87afe;p=thirdparty%2Fzlib-ng.git

[CHUNKCOPY_SAFE] Fix off-by-one error
* When chunk size was more than 8 bytes, the comparison logic failed if safe length was one less than chunk size.
---

diff --git a/chunkset_tpl.h b/chunkset_tpl.h
index 9e8ede559..68b7dedee 100644
--- a/chunkset_tpl.h
+++ b/chunkset_tpl.h
@@ -37,7 +37,8 @@ Z_INTERNAL uint8_t* CHUNKCOPY(uint8_t *out, uint8_t const *from, unsigned len) {
 
 /* Behave like chunkcopy, but avoid writing beyond of legal output. */
 Z_INTERNAL uint8_t* CHUNKCOPY_SAFE(uint8_t *out, uint8_t const *from, unsigned len, uint8_t *safe) {
-    if ((safe - out) < (ptrdiff_t)sizeof(chunk_t)) {
+    len = MIN(len, safe - out + 1);
+    if (len < sizeof(chunk_t)) {
         int32_t use_chunk16 = sizeof(chunk_t) > 16 && (len & 16);
         if (use_chunk16) {
             memcpy(out, from, 16);