Assure that the number of bits for deflatePrime() is valid.

madler · Apr 20, 2018 · 4346a16 · 4346a16 · vielmetti · Mar 26, 2022
1 parent 5c44459
commit 4346a16
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/deflate.c b/deflate.c
@@ -589,7 +589,8 @@ int ZEXPORT deflatePrime (strm, bits, value)
 
     if (deflateStateCheck(strm)) return Z_STREAM_ERROR;
     s = strm->state;
-    if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
+    if (bits < 0 || bits > 16 ||
+        s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
         return Z_BUF_ERROR;
     do {
         put = Buf_size - s->bi_valid;