missing commit

[wxWidgets.git] / src / zlib / inffast.c

diff --git a/src/zlib/inffast.c b/src/zlib/inffast.c
index c716440a92ac9edcf86bd89c10eb82479638bb4f..bbee92ed1e6bd3683d4d497bdf639dd1b05e98bc 100644 (file)
--- a/src/zlib/inffast.c
+++ b/src/zlib/inffast.c
@@ -1,5 +1,5 @@
 /* inffast.c -- fast decoding
 /* inffast.c -- fast decoding

- * Copyright (C) 1995-2003 Mark Adler
+ * Copyright (C) 1995-2004 Mark Adler

  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 


@@ -19,7 +19,7 @@
    - none
    No measurable difference:
    - Pentium III (Anderson)
    - none
    No measurable difference:
    - Pentium III (Anderson)

-   - 68060 (Nikl)
+   - M68060 (Nikl)

  */
 #ifdef POSTINC
 #  define OFF 0
  */
 #ifdef POSTINC
 #  define OFF 0


@@ -74,6 +74,9 @@ unsigned start;         /* inflate()'s starting value for strm->avail_out */
     unsigned char FAR *out;     /* local strm->next_out */
     unsigned char FAR *beg;     /* inflate()'s initial strm->next_out */
     unsigned char FAR *end;     /* while out < end, enough space available */
     unsigned char FAR *out;     /* local strm->next_out */
     unsigned char FAR *beg;     /* inflate()'s initial strm->next_out */
     unsigned char FAR *end;     /* while out < end, enough space available */

+#ifdef INFLATE_STRICT
+    unsigned dmax;              /* maximum distance from zlib header */
+#endif

     unsigned wsize;             /* window size or zero if not using window */
     unsigned whave;             /* valid bytes in the window */
     unsigned write;             /* window write index */
     unsigned wsize;             /* window size or zero if not using window */
     unsigned whave;             /* valid bytes in the window */
     unsigned write;             /* window write index */


@@ -98,6 +101,9 @@ unsigned start;         /* inflate()'s starting value for strm->avail_out */
     out = strm->next_out - OFF;
     beg = out - (start - strm->avail_out);
     end = out + (strm->avail_out - 257);
     out = strm->next_out - OFF;
     beg = out - (start - strm->avail_out);
     end = out + (strm->avail_out - 257);

+#ifdef INFLATE_STRICT
+    dmax = state->dmax;
+#endif

     wsize = state->wsize;
     whave = state->whave;
     write = state->write;
     wsize = state->wsize;
     whave = state->whave;
     write = state->write;


@@ -167,6 +173,13 @@ unsigned start;         /* inflate()'s starting value for strm->avail_out */
                     }
                 }
                 dist += (unsigned)hold & ((1U << op) - 1);
                     }
                 }
                 dist += (unsigned)hold & ((1U << op) - 1);

+#ifdef INFLATE_STRICT
+                if (dist > dmax) {
+                    strm->msg = (char *)"invalid distance too far back";
+                    state->mode = BAD;
+                    break;
+                }
+#endif

                 hold >>= op;
                 bits -= op;
                 Tracevv((stderr, "inflate:         distance %u\n", dist));
                 hold >>= op;
                 bits -= op;
                 Tracevv((stderr, "inflate:         distance %u\n", dist));