From d029df34fc2854eaf717914ccd67e62907af14f8 Mon Sep 17 00:00:00 2001
From: huangFF0904 <625173hhh@gmail.com>
Date: Tue, 16 Dec 2025 22:02:11 +0800
Subject: [PATCH] Fix deflate symbol buffering to prevent buffer overwrite

---
 u-boot-2021.10/lib/zlib/trees.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/u-boot-2021.10/lib/zlib/trees.c b/u-boot-2021.10/lib/zlib/trees.c
index 700c62f6d7..8c897e1ddf 100644
--- a/u-boot-2021.10/lib/zlib/trees.c
+++ b/u-boot-2021.10/lib/zlib/trees.c
@@ -1029,8 +1029,9 @@ int ZLIB_INTERNAL _tr_tally (s, dist, lc)
     unsigned dist;  /* distance of matched string */
     unsigned lc;    /* match length-MIN_MATCH or unmatched char (if dist==0) */
 {
-    s->d_buf[s->last_lit] = (ush)dist;
-    s->l_buf[s->last_lit++] = (uch)lc;
+    s->sym_buf[s->sym_next++] = dist;
+    s->sym_buf[s->sym_next++] = dist >> 8;
+    s->sym_buf[s->sym_next++] = lc;
     if (dist == 0) {
         /* lc is the unmatched char */
         s->dyn_ltree[lc].Freq++;