From: Mika Lindqvist <postmaster@raasu.org>
Date: Tue, 25 Apr 2023 23:19:50 +0000 (+0300)
Subject: Fix out-of-bound access of zng_length_codes.
X-Git-Tag: 2.1.1-beta2~17
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f346148df0123a56b47af0ebc63e7529ae50cb44;p=thirdparty%2Fzlib-ng.git

Fix out-of-bound access of zng_length_codes.
---

diff --git a/deflate_quick.c b/deflate_quick.c
index d616677c5..df5a17b9e 100644
--- a/deflate_quick.c
+++ b/deflate_quick.c
@@ -99,6 +99,8 @@ Z_INTERNAL block_state deflate_quick(deflate_state *s, int flush) {
                     if (match_len >= WANT_MIN_MATCH) {
                         if (UNLIKELY(match_len > s->lookahead))
                             match_len = s->lookahead;
+                        if (UNLIKELY(match_len > STD_MAX_MATCH))
+                            match_len = STD_MAX_MATCH;
 
                         check_match(s, s->strstart, hash_head, match_len);
 
diff --git a/deflate_rle.c b/deflate_rle.c
index 77df71f58..4e3fde09f 100644
--- a/deflate_rle.c
+++ b/deflate_rle.c
@@ -47,6 +47,7 @@ Z_INTERNAL block_state deflate_rle(deflate_state *s, int flush) {
                          scan < strend);
                 match_len = STD_MAX_MATCH - (unsigned int)(strend - scan);
                 match_len = MIN(match_len, s->lookahead);
+                match_len = MIN(match_len, STD_MAX_MATCH);
             }
             Assert(scan <= s->window + s->window_size - 1, "wild scan");
         }