commit 04cba00f859ccd44a517be22c2aeb93bde9c34ce
author Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Thu Jan 12 19:08:54 2023 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Thu Jan 12 19:08:54 2023 +0000
tree c57c88c77fbc80b596ee8b71adf1bdb8a6ea1616
parent f5ce96f26d2db8f4f3e64ce9ec231c19c7ee1041
parent 259b9678a6db8a4448de003b7bc553a8f121916c

Merge cherrypicks of ['ag/20545899'] into security-aosp-tm-release.

Change-Id: I9418ade812caa84e1daf6d8ccb2b0a8bc4cc224c

contrib/optimizations/inflate.c

diff --git a/contrib/optimizations/inflate.c b/contrib/optimizations/inflate.c
index 81d558b..93776ac 100644
--- a/contrib/optimizations/inflate.c
+++ b/contrib/optimizations/inflate.c
@@ -771,8 +771,9 @@
                 if (copy > have) copy = have;
                 if (copy) {
                     if (state->head != Z_NULL &&
-                        state->head->extra != Z_NULL) {
-                        len = state->head->extra_len - state->length;
+                        state->head->extra != Z_NULL &&
+                        (len = state->head->extra_len - state->length) <
+                            state->head->extra_max) {
                         zmemcpy(state->head->extra + len, next,
                                 len + copy > state->head->extra_max ?
                                 state->head->extra_max - len : copy);

inflate.c

diff --git a/inflate.c b/inflate.c
index 68902e8..9057a57 100644
--- a/inflate.c
+++ b/inflate.c
@@ -760,8 +760,9 @@
                 if (copy > have) copy = have;
                 if (copy) {
                     if (state->head != Z_NULL &&
-                        state->head->extra != Z_NULL) {
-                        len = state->head->extra_len - state->length;
+                        state->head->extra != Z_NULL &&
+                        (len = state->head->extra_len - state->length) <
+                            state->head->extra_max) {
                         zmemcpy(state->head->extra + len, next,
                                 len + copy > state->head->extra_max ?
                                 state->head->extra_max - len : copy);