From 42a8b8af21af24bb35548bcd2499c792d1a8c1a3 Mon Sep 17 00:00:00 2001

From: Richard Hughes <richard@hughsie.com>

Date: Wed, 1 Mar 2017 17:15:10 +0000

Subject: [PATCH 4/4] Fix buffer overrun when generating Huffman codes

---

 libgcab/decomp.c | 4 +++-

 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/libgcab/decomp.c b/libgcab/decomp.c

index 52445e8..3ee8f9b 100644

--- a/libgcab/decomp.c

+++ b/libgcab/decomp.c

@@ -190,7 +190,9 @@ struct Ziphuft **t, cab_LONG *m, fdi_decomp_state *decomp_state)

           xp = ZIP(c) + k;

           while (++j < z)       /* try smaller tables up to z bits */

           {

-            if ((f <<= 1) <= *++xp)

+            if (*++xp > ZIPBMAX)

+              return 2;         /* corrupt */

+            if ((f <<= 1) <= *xp)

               break;            /* enough codes to use up j bits */

             f -= *xp;           /* else deduct codes from patterns */

           }

-- 

2.9.3