Merge pull request #329 from iibclothier/master

Remedy CVE-2018-12913

.github/workflows/ci-fuzz.yml

@@ -16,8 +16,8 @@ jobs:
         fuzz-seconds: 900
         dry-run: false
     - name: Upload Crash
-      uses: actions/upload-artifact@v1
+      uses: actions/upload-artifact@v4
       if: failure()
       with:
         name: artifacts
-        path: ./out/artifacts
+        path: ./out/artifacts

miniz_tinfl.c

@@ -490,6 +490,12 @@ extern "C"
                             }
                             bit_buf >>= code_len;
                             num_bits -= code_len;
+                        
+                        /* assert(sym2 != 0 && counter != 0); */
+                        if (sym2 == 0 && counter == 0)
+                        {
+                            TINFL_CR_RETURN_FOREVER(40, TINFL_STATUS_FAILED);
+                        }
 
                             pOut_buf_cur[0] = (mz_uint8)counter;
                             if (sym2 & 256)