| Brad Bishop | 96ff198 | 2019-08-19 13:50:42 -0400 | [diff] [blame] | 1 | From 6a043145ca6e9c55184013841a67b2fef87e44c0 Mon Sep 17 00:00:00 2001 |
| 2 | From: Mark Adler <madler@alumni.caltech.edu> |
| 3 | Date: Wed, 21 Sep 2016 23:35:50 -0700 |
| 4 | Subject: [PATCH] Remove offset pointer optimization in inftrees.c. |
| 5 | |
| 6 | inftrees.c was subtracting an offset from a pointer to an array, |
| 7 | in order to provide a pointer that allowed indexing starting at |
| 8 | the offset. This is not compliant with the C standard, for which |
| 9 | the behavior of a pointer decremented before its allocated memory |
| 10 | is undefined. Per the recommendation of a security audit of the |
| 11 | zlib code by Trail of Bits and TrustInSoft, in support of the |
| 12 | Mozilla Foundation, this tiny optimization was removed, in order |
| 13 | to avoid the possibility of undefined behavior. |
| 14 | |
| 15 | CVE: CVE-2016-9840 |
| 16 | Upstream-Status: Backport |
| 17 | Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> |
| 18 | --- |
| 19 | inftrees.c | 18 ++++++++---------- |
| 20 | 1 file changed, 8 insertions(+), 10 deletions(-) |
| 21 | |
| 22 | diff --git a/zlib/inftrees.c b/zlib/inftrees.c |
| 23 | index 22fcd666..0d2670d5 100644 |
| 24 | --- a/zlib/inftrees.c |
| 25 | +++ b/zlib/inftrees.c |
| 26 | @@ -54,7 +54,7 @@ unsigned short FAR *work; |
| 27 | code FAR *next; /* next available space in table */ |
| 28 | const unsigned short FAR *base; /* base value table to use */ |
| 29 | const unsigned short FAR *extra; /* extra bits table to use */ |
| 30 | - int end; /* use base and extra for symbol > end */ |
| 31 | + unsigned match; /* use base and extra for symbol >= match */ |
| 32 | unsigned short count[MAXBITS+1]; /* number of codes of each length */ |
| 33 | unsigned short offs[MAXBITS+1]; /* offsets in table for each length */ |
| 34 | static const unsigned short lbase[31] = { /* Length codes 257..285 base */ |
| 35 | @@ -181,19 +181,17 @@ unsigned short FAR *work; |
| 36 | switch (type) { |
| 37 | case CODES: |
| 38 | base = extra = work; /* dummy value--not used */ |
| 39 | - end = 19; |
| 40 | + match = 20; |
| 41 | break; |
| 42 | case LENS: |
| 43 | base = lbase; |
| 44 | - base -= 257; |
| 45 | extra = lext; |
| 46 | - extra -= 257; |
| 47 | - end = 256; |
| 48 | + match = 257; |
| 49 | break; |
| 50 | default: /* DISTS */ |
| 51 | base = dbase; |
| 52 | extra = dext; |
| 53 | - end = -1; |
| 54 | + match = 0; |
| 55 | } |
| 56 | |
| 57 | /* initialize state for loop */ |
| 58 | @@ -216,13 +214,13 @@ unsigned short FAR *work; |
| 59 | for (;;) { |
| 60 | /* create table entry */ |
| 61 | here.bits = (unsigned char)(len - drop); |
| 62 | - if ((int)(work[sym]) < end) { |
| 63 | + if (work[sym] + 1 < match) { |
| 64 | here.op = (unsigned char)0; |
| 65 | here.val = work[sym]; |
| 66 | } |
| 67 | - else if ((int)(work[sym]) > end) { |
| 68 | - here.op = (unsigned char)(extra[work[sym]]); |
| 69 | - here.val = base[work[sym]]; |
| 70 | + else if (work[sym] >= match) { |
| 71 | + here.op = (unsigned char)(extra[work[sym] - match]); |
| 72 | + here.val = base[work[sym] - match]; |
| 73 | } |
| 74 | else { |
| 75 | here.op = (unsigned char)(32 + 64); /* end of block */ |