Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
Fix a bug where invalid LZW data could cause out of bounds access.
  • Loading branch information
madler committed Aug 20, 2015
1 parent 52ca317 commit 77ae783
Showing 1 changed file with 8 additions and 4 deletions.
12 changes: 8 additions & 4 deletions pigz.c
Expand Up @@ -3252,16 +3252,19 @@ local void unlzw(void)
machine instruction!) */
{
unsigned rem = ((g.in_tot - g.in_left) - mark) % bits;
if (rem)
if (rem) {
rem = bits - rem;
if (NOMORE())
break; /* end of compressed data */
while (rem > g.in_left) {
rem -= g.in_left;
if (load() == 0)
break;
throw(EDOM, "%s: lzw premature end", g.inf);
}
g.in_left -= rem;
g.in_next += rem;
}
}
buf = 0;
left = 0;

Expand Down Expand Up @@ -3294,16 +3297,17 @@ local void unlzw(void)
/* flush unused input bits and bytes to next 8*bits bit boundary */
{
unsigned rem = ((g.in_tot - g.in_left) - mark) % bits;
if (rem)
if (rem) {
rem = bits - rem;
while (rem > g.in_left) {
rem -= g.in_left;
if (load() == 0)
break;
throw(EDOM, "%s: lzw premature end", g.inf);
}
g.in_left -= rem;
g.in_next += rem;
}
}
buf = 0;
left = 0;

Expand Down

0 comments on commit 77ae783

Please sign in to comment.