Skip to content

Commit 5f58d49

Browse files
authored
Fix a bug when getting a gzip header extra field with inflate(). (#3063)
If the extra field was larger than the space the user provided with inflateGetHeader(), and if multiple calls of inflate() delivered the extra header data, then there could be a buffer overflow of the provided space. This commit assures that provided space is not exceeded.
1 parent 0f2b6c1 commit 5f58d49

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

dlib/external/zlib/inflate.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -758,9 +758,10 @@ int flush;
758758
copy = state->length;
759759
if (copy > have) copy = have;
760760
if (copy) {
761+
len = state->head->extra_len - state->length;
761762
if (state->head != Z_NULL &&
762-
state->head->extra != Z_NULL) {
763-
len = state->head->extra_len - state->length;
763+
state->head->extra != Z_NULL &&
764+
len < state->head->extra_max) {
764765
zmemcpy(state->head->extra + len, next,
765766
len + copy > state->head->extra_max ?
766767
state->head->extra_max - len : copy);

0 commit comments

Comments
 (0)