luo980/miniz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix heap overflow to user buffer in tinfl_status tinfl_decompress

Browse Source
This commit is contained in:
Martin 2018-06-18 22:17:43 +02:00
parent 76237898c0
commit 3616bf804b
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
miniz_tinfl.c
View File

@ -540,18 +540,19 @@ tinfl_status tinfl_decompress(tinfl_decompressor *r, const mz_uint8 *pIn_buf_nex
}
}
#endif
do
while(counter>2)
{
pOut_buf_cur[0] = pSrc[0];
pOut_buf_cur[1] = pSrc[1];
pOut_buf_cur[2] = pSrc[2];
pOut_buf_cur += 3;
pSrc += 3;
} while ((int)(counter -= 3) > 2);
if ((int)counter > 0)
counter -= 3;
}
if (counter > 0)
{
pOut_buf_cur[0] = pSrc[0];
if ((int)counter > 1)
if (counter > 1)
pOut_buf_cur[1] = pSrc[1];
pOut_buf_cur += counter;
}