| Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame^] | 1 | From e54e1299404101a5a9d0cf5e45512b543967f958 Mon Sep 17 00:00:00 2001 |
| 2 | From: Mark Adler <madler@alumni.caltech.edu> |
| 3 | Date: Sat, 5 Sep 2015 17:45:55 -0700 |
| 4 | Subject: [PATCH] Avoid shifts of negative values inflateMark(). |
| 5 | |
| 6 | The C standard says that bit shifts of negative integers is |
| 7 | undefined. This casts to unsigned values to assure a known |
| 8 | result. |
| 9 | |
| 10 | CVE: CVE-2016-9842 |
| 11 | Upstream-Status: Backport |
| 12 | Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> |
| 13 | --- |
| 14 | inflate.c | 5 +++-- |
| 15 | 1 file changed, 3 insertions(+), 2 deletions(-) |
| 16 | |
| 17 | diff --git a/zlib/inflate.c b/zlib/inflate.c |
| 18 | index 2889e3a0..a7184167 100644 |
| 19 | --- a/zlib/inflate.c |
| 20 | +++ b/zlib/inflate.c |
| 21 | @@ -1506,9 +1506,10 @@ z_streamp strm; |
| 22 | { |
| 23 | struct inflate_state FAR *state; |
| 24 | |
| 25 | - if (strm == Z_NULL || strm->state == Z_NULL) return -1L << 16; |
| 26 | + if (strm == Z_NULL || strm->state == Z_NULL) |
| 27 | + return (long)(((unsigned long)0 - 1) << 16); |
| 28 | state = (struct inflate_state FAR *)strm->state; |
| 29 | - return ((long)(state->back) << 16) + |
| 30 | + return (long)(((unsigned long)((long)state->back)) << 16) + |
| 31 | (state->mode == COPY ? state->length : |
| 32 | (state->mode == MATCH ? state->was - state->length : 0)); |
| 33 | } |