Skip to content

Commit edd9e9f

Browse files
committed
Remove offset pointer optimization in inftrees.c.
inftrees.c was subtracting an offset from a pointer to an array, in order to provide a pointer that allowed indexing starting at the offset. This is not compliant with the C standard, for which the behavior of a pointer decremented before its allocated memory is undefined. Per the recommendation of a security audit of the zlib code by Trail of Bits and TrustInSoft, in support of the Mozilla Foundation, this tiny optimization was removed, in order to avoid the possibility of undefined behavior.
1 parent 389516f commit edd9e9f

File tree

1 file changed

+8
-10
lines changed

1 file changed

+8
-10
lines changed

modules/juce_core/zip/zlib/inftrees.c

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ int inflate_table (codetype type,
5353
code FAR *next; /* next available space in table */
5454
const unsigned short FAR *base; /* base value table to use */
5555
const unsigned short FAR *extra; /* extra bits table to use */
56-
int end; /* use base and extra for symbol > end */
56+
unsigned match; /* use base and extra for symbol >= match */
5757
unsigned short count[MAXBITS+1]; /* number of codes of each length */
5858
unsigned short offs[MAXBITS+1]; /* offsets in table for each length */
5959
static const unsigned short lbase[31] = { /* Length codes 257..285 base */
@@ -181,19 +181,17 @@ int inflate_table (codetype type,
181181
switch (type) {
182182
case CODES:
183183
base = extra = work; /* dummy value--not used */
184-
end = 19;
184+
match = 20;
185185
break;
186186
case LENS:
187187
base = lbase;
188-
base -= 257;
189188
extra = lext;
190-
extra -= 257;
191-
end = 256;
189+
match = 257;
192190
break;
193191
default: /* DISTS */
194192
base = dbase;
195193
extra = dext;
196-
end = -1;
194+
match = 0;
197195
}
198196

199197
/* initialize state for loop */
@@ -215,13 +213,13 @@ int inflate_table (codetype type,
215213
for (;;) {
216214
/* create table entry */
217215
thisx.bits = (unsigned char)(len - drop);
218-
if ((int)(work[sym]) < end) {
216+
if (work[sym] + 1 < match) {
219217
thisx.op = (unsigned char)0;
220218
thisx.val = work[sym];
221219
}
222-
else if ((int)(work[sym]) > end) {
223-
thisx.op = (unsigned char)(extra[work[sym]]);
224-
thisx.val = base[work[sym]];
220+
else if (work[sym] >= match) {
221+
thisx.op = (unsigned char)(extra[work[sym] - match]);
222+
thisx.val = base[work[sym] - match];
225223
}
226224
else {
227225
thisx.op = (unsigned char)(32 + 64); /* end of block */

0 commit comments

Comments
 (0)