2 files changed, 4 insertions, 0 deletions
diff --git a/extmod/uzlib/tinf.h b/extmod/uzlib/tinf.h
index 3545bbd883..106203a099 100644
--- a/extmod/uzlib/tinf.h
+++ b/extmod/uzlib/tinf.h
@@ -32,6 +32,7 @@ extern "C" {
 #define TINF_DONE           1
 #define TINF_DATA_ERROR    (-3)
 #define TINF_CHKSUM_ERROR  (-4)
+#define TINF_DICT_ERROR    (-5)
 
 /* checksum types */
 #define TINF_CHKSUM_NONE  0
diff --git a/extmod/uzlib/tinflate.c b/extmod/uzlib/tinflate.c
index 0e53f7f072..58850eb4a2 100644
--- a/extmod/uzlib/tinflate.c
+++ b/extmod/uzlib/tinflate.c
@@ -361,6 +361,9 @@ static int tinf_inflate_block_data(TINF_DATA *d, TINF_TREE *lt, TINF_TREE *dt)
         /* possibly get more bits from distance code */
         offs = tinf_read_bits(d, dist_bits[dist], dist_base[dist]);
         if (d->dict_ring) {
+            if (offs > d->dict_size) {
+                return TINF_DICT_ERROR;
+            }
             d->lzOff = d->dict_idx - offs;
             if (d->lzOff < 0) {
                 d->lzOff += d->dict_size;