diff options
| author | Paul Sokolovsky <pfalcon@users.sourceforge.net> | 2016-10-11 07:10:48 +0300 |
|---|---|---|
| committer | Paul Sokolovsky <pfalcon@users.sourceforge.net> | 2016-10-11 07:13:23 +0300 |
| commit | 39968aaaff575800218b47488f85eed7081cd0cb (patch) | |
| tree | 40354c76a1c9f5211b00badff57deee3dc5047c3 /extmod | |
| parent | 6dff3df501242d106590a48b5ed382b01a97baea (diff) | |
| download | micropython-39968aaaff575800218b47488f85eed7081cd0cb.tar.gz micropython-39968aaaff575800218b47488f85eed7081cd0cb.zip | |
extmod/uzlib: Update to upstream v2.1.
Adds check that LZ offsets fall into the sliding dictionary used. This
catches a case when uzlib.DecompIO with a smaller dictionary is used
to decompress data which was compressed with a larger dictionary.
Previously, this would lead to producing invalid data or crash, now
an exception will be thrown.
Diffstat (limited to 'extmod')
| -rw-r--r-- | extmod/uzlib/tinf.h | 1 | ||||
| -rw-r--r-- | extmod/uzlib/tinflate.c | 3 |
2 files changed, 4 insertions, 0 deletions
diff --git a/extmod/uzlib/tinf.h b/extmod/uzlib/tinf.h index 3545bbd883..106203a099 100644 --- a/extmod/uzlib/tinf.h +++ b/extmod/uzlib/tinf.h @@ -32,6 +32,7 @@ extern "C" { #define TINF_DONE 1 #define TINF_DATA_ERROR (-3) #define TINF_CHKSUM_ERROR (-4) +#define TINF_DICT_ERROR (-5) /* checksum types */ #define TINF_CHKSUM_NONE 0 diff --git a/extmod/uzlib/tinflate.c b/extmod/uzlib/tinflate.c index 0e53f7f072..58850eb4a2 100644 --- a/extmod/uzlib/tinflate.c +++ b/extmod/uzlib/tinflate.c @@ -361,6 +361,9 @@ static int tinf_inflate_block_data(TINF_DATA *d, TINF_TREE *lt, TINF_TREE *dt) /* possibly get more bits from distance code */ offs = tinf_read_bits(d, dist_bits[dist], dist_base[dist]); if (d->dict_ring) { + if (offs > d->dict_size) { + return TINF_DICT_ERROR; + } d->lzOff = d->dict_idx - offs; if (d->lzOff < 0) { d->lzOff += d->dict_size; |