Attachment 41311 Details for Bug 95512

[patch] zlib-fix2.patch

foo.pat (text/plain), 8.50 KB, created by Marcus Meissner on 2005-07-07 11:33:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcus Meissner

Created: 2005-07-07 11:33:34 UTC

Size: 8.50 KB

patch

obsolete

>This patch replaces inflate_table() with a new function inflate_table_safe()
>which gets passed the number of available table entries.
>
>Signed-off-by: Markus F.X.J. Oberhumer <markus@oberhumer.com>
>
>
>diff -ur zlib-1.2.2.3-orig/infback.c zlib-1.2.2.3-safe/infback.c
>--- zlib-1.2.2.3-orig/infback.c	2004-11-13 06:53:31.000000000 +0100
>+++ zlib-1.2.2.3-safe/infback.c	2005-07-06 01:31:18.558131800 +0200
>@@ -92,14 +92,14 @@
>         next = fixed;
>         lenfix = next;
>         bits = 9;
>-        inflate_table(LENS, state->lens, 288, &(next), &(bits), state->work);
>+        inflate_table_safe(LENS, state->lens, 288, &(next), 512, &(bits), state->work);
> 
>         /* distance table */
>         sym = 0;
>         while (sym < 32) state->lens[sym++] = 5;
>         distfix = next;
>         bits = 5;
>-        inflate_table(DISTS, state->lens, 32, &(next), &(bits), state->work);
>+        inflate_table_safe(DISTS, state->lens, 32, &(next), 32, &(bits), state->work);
> 
>         /* do this just once */
>         virgin = 0;
>@@ -376,7 +376,8 @@
>             state->next = state->codes;
>             state->lencode = (code const FAR *)(state->next);
>             state->lenbits = 7;
>-            ret = inflate_table(CODES, state->lens, 19, &(state->next),
>+            ret = inflate_table_safe(CODES, state->lens, 19, 
>+                                &(state->next), ENOUGH,
>                                 &(state->lenbits), state->work);
>             if (ret) {
>                 strm->msg = (char *)"invalid code lengths set";
>@@ -442,7 +443,8 @@
>             state->next = state->codes;
>             state->lencode = (code const FAR *)(state->next);
>             state->lenbits = 9;
>-            ret = inflate_table(LENS, state->lens, state->nlen, &(state->next),
>+            ret = inflate_table_safe(LENS, state->lens, state->nlen,
>+                                &(state->next), ENOUGH,
>                                 &(state->lenbits), state->work);
>             if (ret) {
>                 strm->msg = (char *)"invalid literal/lengths set";
>@@ -451,8 +453,9 @@
>             }
>             state->distcode = (code const FAR *)(state->next);
>             state->distbits = 6;
>-            ret = inflate_table(DISTS, state->lens + state->nlen, state->ndist,
>-                            &(state->next), &(state->distbits), state->work);
>+            ret = inflate_table_safe(DISTS, state->lens + state->nlen, state->ndist,
>+                            &(state->next), ENOUGH - (unsigned) (state->next - state->codes),
>+                            &(state->distbits), state->work);
>             if (ret) {
>                 strm->msg = (char *)"invalid distances set";
>                 state->mode = BAD;
>diff -ur zlib-1.2.2.3-orig/inflate.c zlib-1.2.2.3-safe/inflate.c
>--- zlib-1.2.2.3-orig/inflate.c	2005-05-28 08:40:42.000000000 +0200
>+++ zlib-1.2.2.3-safe/inflate.c	2005-07-06 01:31:12.992977832 +0200
>@@ -207,14 +207,14 @@
>         next = fixed;
>         lenfix = next;
>         bits = 9;
>-        inflate_table(LENS, state->lens, 288, &(next), &(bits), state->work);
>+        inflate_table_safe(LENS, state->lens, 288, &(next), 512, &(bits), state->work);
> 
>         /* distance table */
>         sym = 0;
>         while (sym < 32) state->lens[sym++] = 5;
>         distfix = next;
>         bits = 5;
>-        inflate_table(DISTS, state->lens, 32, &(next), &(bits), state->work);
>+        inflate_table_safe(DISTS, state->lens, 32, &(next), 32, &(bits), state->work);
> 
>         /* do this just once */
>         virgin = 0;
>@@ -846,7 +846,8 @@
>             state->next = state->codes;
>             state->lencode = (code const FAR *)(state->next);
>             state->lenbits = 7;
>-            ret = inflate_table(CODES, state->lens, 19, &(state->next),
>+            ret = inflate_table_safe(CODES, state->lens, 19, 
>+                                &(state->next), ENOUGH,
>                                 &(state->lenbits), state->work);
>             if (ret) {
>                 strm->msg = (char *)"invalid code lengths set";
>@@ -912,7 +913,8 @@
>             state->next = state->codes;
>             state->lencode = (code const FAR *)(state->next);
>             state->lenbits = 9;
>-            ret = inflate_table(LENS, state->lens, state->nlen, &(state->next),
>+            ret = inflate_table_safe(LENS, state->lens, state->nlen,
>+                                &(state->next), ENOUGH,
>                                 &(state->lenbits), state->work);
>             if (ret) {
>                 strm->msg = (char *)"invalid literal/lengths set";
>@@ -921,8 +923,9 @@
>             }
>             state->distcode = (code const FAR *)(state->next);
>             state->distbits = 6;
>-            ret = inflate_table(DISTS, state->lens + state->nlen, state->ndist,
>-                            &(state->next), &(state->distbits), state->work);
>+            ret = inflate_table_safe(DISTS, state->lens + state->nlen, state->ndist,
>+                            &(state->next), ENOUGH - (unsigned) (state->next - state->codes),
>+                            &(state->distbits), state->work);
>             if (ret) {
>                 strm->msg = (char *)"invalid distances set";
>                 state->mode = BAD;
>diff -ur zlib-1.2.2.3-orig/inftrees.c zlib-1.2.2.3-safe/inftrees.c
>--- zlib-1.2.2.3-orig/inftrees.c	2005-02-06 22:45:27.000000000 +0100
>+++ zlib-1.2.2.3-safe/inftrees.c	2005-07-06 01:35:02.478090792 +0200
>@@ -29,11 +29,12 @@
>    table index bits.  It will differ if the request is greater than the
>    longest code or if it is less than the shortest code.
>  */
>-int inflate_table(type, lens, codes, table, bits, work)
>+int inflate_table_safe(type, lens, codes, table, avail, bits, work)
> codetype type;
>-unsigned short FAR *lens;
>+const unsigned short FAR *lens;
> unsigned codes;
> code FAR * FAR *table;
>+unsigned avail;
> unsigned FAR *bits;
> unsigned short FAR *work;
> {
>@@ -103,6 +104,8 @@
>        decoding tables.
>      */
> 
>+restart:
>+
>     /* accumulate lengths for codes (assumes lens[] all in 0..MAXBITS) */
>     for (len = 0; len <= MAXBITS; len++)
>         count[len] = 0;
>@@ -209,7 +212,7 @@
>     mask = used - 1;            /* mask for comparing low */
> 
>     /* check available table space */
>-    if (type == LENS && used >= ENOUGH - MAXD)
>+    if (used > avail)
>         return 1;
> 
>     /* process all codes and make table entries */
>@@ -276,8 +279,15 @@
> 
>             /* check for enough space */
>             used += 1U << curr;
>-            if (type == LENS && used >= ENOUGH - MAXD)
>+            if (used > avail) {
>+                /* we usually can handle pathological sub-table overflows by
>+                   restarting with a bigger root-table */
>+                if (root < max) {
>+                    *bits = root + 1;
>+                    goto restart;
>+                }
>                 return 1;
>+            }
> 
>             /* point entry in root table to sub-table */
>             low = huff & mask;
>@@ -326,3 +336,27 @@
>     *bits = root;
>     return 0;
> }
>+
>+
>+#if 0
>+/* XXX do we really want to keep this ??? */
>+/* this is not used any longer, but might be called by external functions */
>+
>+extern int inflate_table OF((codetype type, const unsigned short FAR *lens,
>+                             unsigned codes, code FAR * FAR *table,
>+                             unsigned FAR *bits, unsigned short FAR *work));
>+
>+int inflate_table(type, lens, codes, table, bits, work)
>+codetype type;
>+const unsigned short FAR *lens;
>+unsigned codes;
>+code FAR * FAR *table;
>+unsigned FAR *bits;
>+unsigned short FAR *work;
>+{
>+    unsigned avail = ~(0u);
>+    if (type == LENS) avail = ENOUGH - 156;
>+    return inflate_table_safe(type, lens, codes, table, avail, bits, work);
>+}
>+#endif
>+
>diff -ur zlib-1.2.2.3-orig/inftrees.h zlib-1.2.2.3-safe/inftrees.h
>--- zlib-1.2.2.3-orig/inftrees.h	2003-08-11 00:15:50.000000000 +0200
>+++ zlib-1.2.2.3-safe/inftrees.h	2005-07-06 00:57:12.070245248 +0200
>@@ -41,7 +41,11 @@
>    exhaustive search).  The true maximum is not known, but the value
>    below is more than safe. */
> #define ENOUGH 1440
>+#if 0
> #define MAXD 154
>+#else
>+/* MAXD no longer needed; FIXME: update comments */
>+#endif
> 
> /* Type of code to build for inftable() */
> typedef enum {
>@@ -50,6 +54,8 @@
>     DISTS
> } codetype;
> 
>-extern int inflate_table OF((codetype type, unsigned short FAR *lens,
>-                             unsigned codes, code FAR * FAR *table,
>+extern int inflate_table_safe OF((codetype type,
>+                             const unsigned short FAR *lens, unsigned codes,
>+                             code FAR * FAR *table, unsigned avail,
>                              unsigned FAR *bits, unsigned short FAR *work));
>+
>
>

Actions: View | Diff

Attachments on bug 95512: 41311 | 42750