luo980/miniz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix heap overflow to user buffer in tinfl_status tinfl_decompress

Browse Source
This commit is contained in:
Martin 2018-06-18 22:17:43 +02:00
parent 76237898c0
commit 3616bf804b
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
miniz_tinfl.c
View File

@ -540,18 +540,19 @@ tinfl_status tinfl_decompress(tinfl_decompressor *r, const mz_uint8 *pIn_buf_nex
} }
} }
#endif #endif
do while(counter>2)
{ {
pOut_buf_cur[0] = pSrc[0]; pOut_buf_cur[0] = pSrc[0];
pOut_buf_cur[1] = pSrc[1]; pOut_buf_cur[1] = pSrc[1];
pOut_buf_cur[2] = pSrc[2]; pOut_buf_cur[2] = pSrc[2];
pOut_buf_cur += 3; pOut_buf_cur += 3;
pSrc += 3; pSrc += 3;
} while ((int)(counter -= 3) > 2); counter -= 3;
if ((int)counter > 0) }
if (counter > 0)
{ {
pOut_buf_cur[0] = pSrc[0]; pOut_buf_cur[0] = pSrc[0];
if ((int)counter > 1) if (counter > 1)
pOut_buf_cur[1] = pSrc[1]; pOut_buf_cur[1] = pSrc[1];
pOut_buf_cur += counter; pOut_buf_cur += counter;
} }