CVS commit: src/common/dist/zlib

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    src
Committed By:   wiz
Date:           Thu Mar 24 10:13:01 UTC 2022

Modified Files:
        src/common/dist/zlib: deflate.c deflate.h trees.c

Log Message:
zlib: Fix a bug that can crash deflate on some input when using Z_FIXED.

https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531

This bug was reported by Danilo Ramos of Eideticom, Inc. It has
lain in wait 13 years before being found! The bug was introduced
in zlib 1.2.2.2, with the addition of the Z_FIXED option. That
option forces the use of fixed Huffman codes. For rare inputs with
a large number of distant matches, the pending buffer into which
the compressed data is written can overwrite the distance symbol
table which it overlays. That results in corrupted output due to
invalid distances, and can result in out-of-bound accesses,
crashing the application.

The fix here combines the distance buffer and literal/length
buffers into a single symbol buffer. Now three bytes of pending
buffer space are opened up for each literal or length/distance
pair consumed, instead of the previous two bytes. This assures
that the pending buffer cannot overwrite the symbol table, since
the maximum fixed code compressed length/distance is 31 bits, and
since there are four bytes of pending space for every three bytes
of symbol space.


To generate a diff of this commit:
cvs rdiff -u -r1.4 -r1.5 src/common/dist/zlib/deflate.c \
    src/common/dist/zlib/trees.c
cvs rdiff -u -r1.3 -r1.4 src/common/dist/zlib/deflate.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.