blob: 41b8d2a30a5d4b8c9469a4eea5ea822292baa5d4 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
|
commit e54e1299404101a5a9d0cf5e45512b543967f958
Author: Mark Adler <madler@alumni.caltech.edu>
Date: Sat Sep 5 17:45:55 2015 -0700
Avoid shifts of negative values inflateMark().
The C standard says that bit shifts of negative integers is
undefined. This casts to unsigned values to assure a known
result.
Upstream-Status: Backport
http://http.debian.net/debian/pool/main/z/zlib/zlib_1.2.8.dfsg-5.debian.tar.xz
https://github.com/madler/zlib/commit/e54e1299404101a5a9d0cf5e45512b543967f958
CVE: CVE-2016-9842
Signed-off-by: George McCollister <george.mccollister@gmail.com>
diff --git a/inflate.c b/inflate.c
index 2889e3a..a718416 100644
--- a/inflate.c
+++ b/inflate.c
@@ -1506,9 +1506,10 @@ z_streamp strm;
{
struct inflate_state FAR *state;
- if (strm == Z_NULL || strm->state == Z_NULL) return -1L << 16;
+ if (strm == Z_NULL || strm->state == Z_NULL)
+ return (long)(((unsigned long)0 - 1) << 16);
state = (struct inflate_state FAR *)strm->state;
- return ((long)(state->back) << 16) +
+ return (long)(((unsigned long)((long)state->back)) << 16) +
(state->mode == COPY ? state->length :
(state->mode == MATCH ? state->was - state->length : 0));
}
|
