diff options
| author | Marko Mäkelä <marko.makela@mariadb.com> | 2023-05-11 14:05:52 +0300 |
|---|---|---|
| committer | Marko Mäkelä <marko.makela@mariadb.com> | 2023-05-11 14:05:52 +0300 |
| commit | cd5ca0b11882cfa8eafa8c687ed3084423bc7e52 (patch) | |
| tree | 92045e255e18d9acbe7cd8385c64c9f1830db257 /zlib/inflate.c | |
| parent | 78a1264cfae37667a2812c5bb5cc6638d9eed5ff (diff) | |
| parent | c271057288f71746d1816824f338f2d9c47f67c1 (diff) | |
| download | mariadb-git-bb-10.6-MDEV-29911.tar.gz | |
Merge 10.6bb-10.6-MDEV-29911
Diffstat (limited to 'zlib/inflate.c')
| -rw-r--r-- | zlib/inflate.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/zlib/inflate.c b/zlib/inflate.c index 7be8c63662a..8acbef44e99 100644 --- a/zlib/inflate.c +++ b/zlib/inflate.c @@ -168,6 +168,8 @@ int windowBits; /* extract wrap request from windowBits parameter */ if (windowBits < 0) { + if (windowBits < -15) + return Z_STREAM_ERROR; wrap = 0; windowBits = -windowBits; } @@ -764,8 +766,9 @@ int flush; if (copy > have) copy = have; if (copy) { if (state->head != Z_NULL && - state->head->extra != Z_NULL) { - len = state->head->extra_len - state->length; + state->head->extra != Z_NULL && + (len = state->head->extra_len - state->length) < + state->head->extra_max) { zmemcpy(state->head->extra + len, next, len + copy > state->head->extra_max ? state->head->extra_max - len : copy); |