@@ -276,11 +276,6 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
276276 int wrap = 1 ;
277277 static const char my_version [] = ZLIB_VERSION ;
278278
279- ushf * overlay ;
280- /* We overlay pending_buf and d_buf+l_buf. This works since the average
281- * output size for (length,distance) codes is <= 24 bits.
282- */
283-
284279 if (version == Z_NULL || version [0 ] != my_version [0 ] ||
285280 stream_size != sizeof (z_stream )) {
286281 return Z_VERSION_ERROR ;
@@ -350,9 +345,47 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
350345
351346 s -> lit_bufsize = 1 << (memLevel + 6 ); /* 16K elements by default */
352347
353- overlay = (ushf * ) ZALLOC (strm , s -> lit_bufsize , sizeof (ush )+ 2 );
354- s -> pending_buf = (uchf * ) overlay ;
355- s -> pending_buf_size = (ulg )s -> lit_bufsize * (sizeof (ush )+ 2L );
348+ /* We overlay pending_buf and sym_buf. This works since the average size
349+ * for length/distance pairs over any compressed block is assured to be 31
350+ * bits or less.
351+ *
352+ * Analysis: The longest fixed codes are a length code of 8 bits plus 5
353+ * extra bits, for lengths 131 to 257. The longest fixed distance codes are
354+ * 5 bits plus 13 extra bits, for distances 16385 to 32768. The longest
355+ * possible fixed-codes length/distance pair is then 31 bits total.
356+ *
357+ * sym_buf starts one-fourth of the way into pending_buf. So there are
358+ * three bytes in sym_buf for every four bytes in pending_buf. Each symbol
359+ * in sym_buf is three bytes -- two for the distance and one for the
360+ * literal/length. As each symbol is consumed, the pointer to the next
361+ * sym_buf value to read moves forward three bytes. From that symbol, up to
362+ * 31 bits are written to pending_buf. The closest the written pending_buf
363+ * bits gets to the next sym_buf symbol to read is just before the last
364+ * code is written. At that time, 31*(n-2) bits have been written, just
365+ * after 24*(n-2) bits have been consumed from sym_buf. sym_buf starts at
366+ * 8*n bits into pending_buf. (Note that the symbol buffer fills when n-1
367+ * symbols are written.) The closest the writing gets to what is unread is
368+ * then n+14 bits. Here n is lit_bufsize, which is 16384 by default, and
369+ * can range from 128 to 32768.
370+ *
371+ * Therefore, at a minimum, there are 142 bits of space between what is
372+ * written and what is read in the overlain buffers, so the symbols cannot
373+ * be overwritten by the compressed data. That space is actually 139 bits,
374+ * due to the three-bit fixed-code block header.
375+ *
376+ * That covers the case where either Z_FIXED is specified, forcing fixed
377+ * codes, or when the use of fixed codes is chosen, because that choice
378+ * results in a smaller compressed block than dynamic codes. That latter
379+ * condition then assures that the above analysis also covers all dynamic
380+ * blocks. A dynamic-code block will only be chosen to be emitted if it has
381+ * fewer bits than a fixed-code block would for the same set of symbols.
382+ * Therefore its average symbol length is assured to be less than 31. So
383+ * the compressed data for a dynamic block also cannot overwrite the
384+ * symbols from which it is being constructed.
385+ */
386+
387+ s -> pending_buf = (uchf * ) ZALLOC (strm , s -> lit_bufsize , 4 );
388+ s -> pending_buf_size = (ulg )s -> lit_bufsize * 4 ;
356389
357390 if (s -> window == Z_NULL || s -> prev == Z_NULL || s -> head == Z_NULL ||
358391 s -> pending_buf == Z_NULL ) {
@@ -361,8 +394,12 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
361394 deflateEnd (strm );
362395 return Z_MEM_ERROR ;
363396 }
364- s -> d_buf = overlay + s -> lit_bufsize /sizeof (ush );
365- s -> l_buf = s -> pending_buf + (1 + sizeof (ush ))* s -> lit_bufsize ;
397+ s -> sym_buf = s -> pending_buf + s -> lit_bufsize ;
398+ s -> sym_end = (s -> lit_bufsize - 1 ) * 3 ;
399+ /* We avoid equality with lit_bufsize*3 because of wraparound at 64K
400+ * on 16 bit machines and because stored blocks are restricted to
401+ * 64K-1 bytes.
402+ */
366403
367404 s -> level = level ;
368405 s -> strategy = strategy ;
@@ -573,7 +610,8 @@ int ZEXPORT deflatePrime (strm, bits, value)
573610
574611 if (deflateStateCheck (strm )) return Z_STREAM_ERROR ;
575612 s = strm -> state ;
576- if ((Bytef * )(s -> d_buf ) < s -> pending_out + ((Buf_size + 7 ) >> 3 ))
613+ if (bits < 0 || bits > 16 ||
614+ s -> sym_buf < s -> pending_out + ((Buf_size + 7 ) >> 3 ))
577615 return Z_BUF_ERROR ;
578616 do {
579617 put = Buf_size - s -> bi_valid ;
@@ -1132,7 +1170,6 @@ int ZEXPORT deflateCopy (dest, source)
11321170#else
11331171 deflate_state * ds ;
11341172 deflate_state * ss ;
1135- ushf * overlay ;
11361173
11371174
11381175 if (deflateStateCheck (source ) || dest == Z_NULL ) {
@@ -1152,8 +1189,7 @@ int ZEXPORT deflateCopy (dest, source)
11521189 ds -> window = (Bytef * ) ZALLOC (dest , ds -> w_size , 2 * sizeof (Byte ));
11531190 ds -> prev = (Posf * ) ZALLOC (dest , ds -> w_size , sizeof (Pos ));
11541191 ds -> head = (Posf * ) ZALLOC (dest , ds -> hash_size , sizeof (Pos ));
1155- overlay = (ushf * ) ZALLOC (dest , ds -> lit_bufsize , sizeof (ush )+ 2 );
1156- ds -> pending_buf = (uchf * ) overlay ;
1192+ ds -> pending_buf = (uchf * ) ZALLOC (dest , ds -> lit_bufsize , 4 );
11571193
11581194 if (ds -> window == Z_NULL || ds -> prev == Z_NULL || ds -> head == Z_NULL ||
11591195 ds -> pending_buf == Z_NULL ) {
@@ -1167,8 +1203,7 @@ int ZEXPORT deflateCopy (dest, source)
11671203 zmemcpy (ds -> pending_buf , ss -> pending_buf , (uInt )ds -> pending_buf_size );
11681204
11691205 ds -> pending_out = ds -> pending_buf + (ss -> pending_out - ss -> pending_buf );
1170- ds -> d_buf = overlay + ds -> lit_bufsize /sizeof (ush );
1171- ds -> l_buf = ds -> pending_buf + (1 + sizeof (ush ))* ds -> lit_bufsize ;
1206+ ds -> sym_buf = ds -> pending_buf + ds -> lit_bufsize ;
11721207
11731208 ds -> l_desc .dyn_tree = ds -> dyn_ltree ;
11741209 ds -> d_desc .dyn_tree = ds -> dyn_dtree ;
@@ -1936,7 +1971,7 @@ local block_state deflate_fast(s, flush)
19361971 FLUSH_BLOCK (s , 1 );
19371972 return finish_done ;
19381973 }
1939- if (s -> last_lit )
1974+ if (s -> sym_next )
19401975 FLUSH_BLOCK (s , 0 );
19411976 return block_done ;
19421977}
@@ -2067,7 +2102,7 @@ local block_state deflate_slow(s, flush)
20672102 FLUSH_BLOCK (s , 1 );
20682103 return finish_done ;
20692104 }
2070- if (s -> last_lit )
2105+ if (s -> sym_next )
20712106 FLUSH_BLOCK (s , 0 );
20722107 return block_done ;
20732108}
@@ -2142,7 +2177,7 @@ local block_state deflate_rle(s, flush)
21422177 FLUSH_BLOCK (s , 1 );
21432178 return finish_done ;
21442179 }
2145- if (s -> last_lit )
2180+ if (s -> sym_next )
21462181 FLUSH_BLOCK (s , 0 );
21472182 return block_done ;
21482183}
@@ -2181,7 +2216,7 @@ local block_state deflate_huff(s, flush)
21812216 FLUSH_BLOCK (s , 1 );
21822217 return finish_done ;
21832218 }
2184- if (s -> last_lit )
2219+ if (s -> sym_next )
21852220 FLUSH_BLOCK (s , 0 );
21862221 return block_done ;
21872222}
0 commit comments