fix for CAN-2004-0797 zlib-1.2.x vulnerability (patch #1018094)

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@28941 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775

diff --git a/src/zlib/infback.c b/src/zlib/infback.c
index 110b03b857f26c3e76793a687ca6d8f55890a1a8..e9709984a8986852e4715cf978203af6b59f58d3 100644 (file)
--- a/src/zlib/infback.c
+++ b/src/zlib/infback.c
@@ -434,6 +434,9 @@ void FAR *out_desc;
                 }
             }
 
                 }
             }
 

+            if (state->mode == BAD)
+                break;
+

             /* build code tables */
             state->next = state->codes;
             state->lencode = (code const FAR *)(state->next);
             /* build code tables */
             state->next = state->codes;
             state->lencode = (code const FAR *)(state->next);

diff --git a/src/zlib/inflate.c b/src/zlib/inflate.c
index a53b5c7446ebd7f097942faa28618cb897a51169..be67fd6920056b9cad0b8d871f36ee8c1c7a2051 100644 (file)
--- a/src/zlib/inflate.c
+++ b/src/zlib/inflate.c
@@ -861,6 +861,9 @@ int flush;
                 }
             }
 
                 }
             }
 

+            if (state->mode == BAD)
+                break;
+

             /* build code tables */
             state->next = state->codes;
             state->lencode = (code const FAR *)(state->next);
             /* build code tables */
             state->next = state->codes;
             state->lencode = (code const FAR *)(state->next);