summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorThiemo Nagel <thiemo.nagel@ph.tum.de>2009-08-16 16:48:37 +0200
committerJim Meyering <meyering@redhat.com>2009-08-18 09:28:06 +0200
commit39a362ae9d9b007473381dba5032f4dfc1744cf2 (patch)
tree83234717daa5b115400a424d37e0f33627f02968
parent3fe0caeada6aa3abca87b5099594bd87e5dfccfe (diff)
downloadgzip-39a362ae9d9b007473381dba5032f4dfc1744cf2.tar.gz
avoid creating an undersized buffer for the hufts table
A malformed input file can cause gzip to crash with a segmentation violation or hang in an endless loop. Reported in <http://bugs.debian.org/507263>. * NEWS (Bug fixes): Mention it.
-rw-r--r--NEWS2
-rw-r--r--inflate.c6
2 files changed, 6 insertions, 2 deletions
diff --git a/NEWS b/NEWS
index 0e6918d..428c214 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,8 @@ GNU gzip NEWS -*- outline -*-
gzip no longer ignores a close-induced write failure, e.g., on NFS
+ gzip -d no longer segfaults on certain invalid inputs
+
Major changes in Gzip 1.3.12 (2007-04-13)
diff --git a/inflate.c b/inflate.c
index 7dd630a..2f8670d 100644
--- a/inflate.c
+++ b/inflate.c
@@ -335,13 +335,15 @@ int *m; /* maximum lookup bits, returns actual */
} while (--i);
if (c[0] == n) /* null input--all zero length codes */
{
- q = (struct huft *) malloc (2 * sizeof *q);
+ q = (struct huft *) malloc (3 * sizeof *q);
if (!q)
return 3;
- hufts += 2;
+ hufts += 3;
q[0].v.t = (struct huft *) NULL;
q[1].e = 99; /* invalid code marker */
q[1].b = 1;
+ q[2].e = 99; /* invalid code marker */
+ q[2].b = 1;
*t = q + 1;
*m = 1;
return 0;