Commit b260dc9fab7c8eac410f49ef5f1d173db69b7ac8
2015-10-04T07:39:22
[bzip2, gzip] Avoid access of unitialized memory (#46109). * src/bzip2/ftbzip2.c (ft_bzip2_file_fill_input), src/gzip/ftgzip.c (ft_gzip_file_fill_input): In case of an error, adjust the limit to avoid copying uninitialized memory.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71
diff --git a/ChangeLog b/ChangeLog
index b0946c7..d7014cd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,14 @@
[bzip2, gzip] Avoid access of unitialized memory (#46109).
+ * src/bzip2/ftbzip2.c (ft_bzip2_file_fill_input), src/gzip/ftgzip.c
+ (ft_gzip_file_fill_input): In case of an error, adjust the limit to
+ avoid copying uninitialized memory.
+
+2015-10-03 Werner Lemberg <wl@gnu.org>
+
+ [bzip2, gzip] Avoid access of unitialized memory (#46109).
+
* src/bzip2/ftbzip2.c (ft_bzip2_file_fill_output), src/gzip/ftgzip.c
(ft_gzip_file_fill_output): In case of an error, adjust the limit to
avoid copying uninitialized memory.
diff --git a/src/bzip2/ftbzip2.c b/src/bzip2/ftbzip2.c
index d4a85f2..cf94733 100644
--- a/src/bzip2/ftbzip2.c
+++ b/src/bzip2/ftbzip2.c
@@ -254,7 +254,10 @@
size = stream->read( stream, stream->pos, zip->input,
FT_BZIP2_BUFFER_SIZE );
if ( size == 0 )
+ {
+ zip->limit = zip->cursor;
return FT_THROW( Invalid_Stream_Operation );
+ }
}
else
{
@@ -263,7 +266,10 @@
size = FT_BZIP2_BUFFER_SIZE;
if ( size == 0 )
+ {
+ zip->limit = zip->cursor;
return FT_THROW( Invalid_Stream_Operation );
+ }
FT_MEM_COPY( zip->input, stream->base + stream->pos, size );
}
diff --git a/src/gzip/ftgzip.c b/src/gzip/ftgzip.c
index 36134a8..422035c 100644
--- a/src/gzip/ftgzip.c
+++ b/src/gzip/ftgzip.c
@@ -377,7 +377,10 @@
size = stream->read( stream, stream->pos, zip->input,
FT_GZIP_BUFFER_SIZE );
if ( size == 0 )
+ {
+ zip->limit = zip->cursor;
return FT_THROW( Invalid_Stream_Operation );
+ }
}
else
{
@@ -386,7 +389,10 @@
size = FT_GZIP_BUFFER_SIZE;
if ( size == 0 )
+ {
+ zip->limit = zip->cursor;
return FT_THROW( Invalid_Stream_Operation );
+ }
FT_MEM_COPY( zip->input, stream->base + stream->pos, size );
}