commit 1c4806afd7ae034aa9f86df35d4341a0b175a90a
author Sadaf Ebrahimi <sadafebrahimi@google.com> Tue Nov 22 22:00:13 2022 +0000
committer Sadaf Ebrahimi <sadafebrahimi@google.com> Tue Nov 22 22:11:58 2022 +0000
tree 7efd1dcb6cb590f747048e71132b4f2277ad1560
parent 83fda04e5ad89925b4018d3e658ca8f41e7adac3

Fix a bug when getting a gzip header extra field with inflate().

If the extra field was larger than the space the user provided with
inflateGetHeader(), and if multiple calls of inflate() delivered
the extra header data, then there could be a buffer overflow of the
provided space. This commit assures that provided space is not
exceeded.

Bug: http://b/242299736
Test: TreeHugger

Change-Id: I4eabb3e135c1568e06b2b9740651a3ae11b21140

contrib/optimizations/inflate.c

diff --git a/contrib/optimizations/inflate.c b/contrib/optimizations/inflate.c
index 81d558b..93776ac 100644
--- a/contrib/optimizations/inflate.c
+++ b/contrib/optimizations/inflate.c
@@ -771,8 +771,9 @@
                 if (copy > have) copy = have;
                 if (copy) {
                     if (state->head != Z_NULL &&
-                        state->head->extra != Z_NULL) {
-                        len = state->head->extra_len - state->length;
+                        state->head->extra != Z_NULL &&
+                        (len = state->head->extra_len - state->length) <
+                            state->head->extra_max) {
                         zmemcpy(state->head->extra + len, next,
                                 len + copy > state->head->extra_max ?
                                 state->head->extra_max - len : copy);

inflate.c

diff --git a/inflate.c b/inflate.c
index 68902e8..9057a57 100644
--- a/inflate.c
+++ b/inflate.c
@@ -760,8 +760,9 @@
                 if (copy > have) copy = have;
                 if (copy) {
                     if (state->head != Z_NULL &&
-                        state->head->extra != Z_NULL) {
-                        len = state->head->extra_len - state->length;
+                        state->head->extra != Z_NULL &&
+                        (len = state->head->extra_len - state->length) <
+                            state->head->extra_max) {
                         zmemcpy(state->head->extra + len, next,
                                 len + copy > state->head->extra_max ?
                                 state->head->extra_max - len : copy);