diff options
| author | Sadaf Ebrahimi <sadafebrahimi@google.com> | 2023-01-13 23:31:15 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2023-01-13 23:31:15 +0000 |
| commit | bc6c281a80a419bcaf16431fe7d9a76dafbd6efd (patch) | |
| tree | 7523d321dd5364cebd7d55872a91646b333490be | |
| parent | 42324c4bf5a7d2e346ed83301199fc61e15e37e2 (diff) | |
| parent | 603297b517ab88d5ee811cba8995998ad43a3094 (diff) | |
| download | angle-bc6c281a80a419bcaf16431fe7d9a76dafbd6efd.tar.gz | |
[automerge] Fix a bug when getting a gzip header extra field with inflate(). 2p: b8b2479b44 am: 9cd61595ad am: d5431ffadc am: 603297b517
Original change: https://googleplex-android-review.googlesource.com/c/platform/external/angle/+/20874827
Change-Id: I7007d75644d1b141b818eee77965fd8438ca888b
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
| -rw-r--r-- | third_party/zlib/contrib/optimizations/inflate.c | 5 | ||||
| -rw-r--r-- | third_party/zlib/inflate.c | 5 |
2 files changed, 6 insertions, 4 deletions
diff --git a/third_party/zlib/contrib/optimizations/inflate.c b/third_party/zlib/contrib/optimizations/inflate.c index 4841cd964c..bb223af9c5 100644 --- a/third_party/zlib/contrib/optimizations/inflate.c +++ b/third_party/zlib/contrib/optimizations/inflate.c @@ -772,8 +772,9 @@ int flush; if (copy > have) copy = have; if (copy) { if (state->head != Z_NULL && - state->head->extra != Z_NULL) { - len = state->head->extra_len - state->length; + state->head->extra != Z_NULL && + (len = state->head->extra_len - state->length) < + state->head->extra_max) { zmemcpy(state->head->extra + len, next, len + copy > state->head->extra_max ? state->head->extra_max - len : copy); diff --git a/third_party/zlib/inflate.c b/third_party/zlib/inflate.c index 7543c33def..a9e2dddba4 100644 --- a/third_party/zlib/inflate.c +++ b/third_party/zlib/inflate.c @@ -761,8 +761,9 @@ int flush; if (copy > have) copy = have; if (copy) { if (state->head != Z_NULL && - state->head->extra != Z_NULL) { - len = state->head->extra_len - state->length; + state->head->extra != Z_NULL && + (len = state->head->extra_len - state->length) < + state->head->extra_max) { zmemcpy(state->head->extra + len, next, len + copy > state->head->extra_max ? state->head->extra_max - len : copy); |