From: tb <tb@openbsd.org>
Date: Thu, 5 Sep 2024 16:16:54 +0000 (+0000)
Subject: Avoid out-of-bounds pointer arithmetic in inflateCopy().
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=b9bd0f6b85133c5a2ba753b0f06d4db3e920dcbf;p=openbsd

Avoid out-of-bounds pointer arithmetic in inflateCopy().

from upstream, no ABI or API change.
ok beck deraadt
---

diff --git a/lib/libz/inflate.c b/lib/libz/inflate.c
index 008f508ff8b..c4f80cfa06c 100644
--- a/lib/libz/inflate.c
+++ b/lib/libz/inflate.c
@@ -960,7 +960,7 @@ int ZEXPORT inflate(z_streamp strm, int flush) {
             while (state->have < 19)
                 state->lens[order[state->have++]] = 0;
             state->next = state->codes;
-            state->lencode = (const code FAR *)(state->next);
+            state->lencode = state->distcode = (const code FAR *)(state->next);
             state->lenbits = 7;
             ret = inflate_table(CODES, state->lens, 19, &(state->next),
                                 &(state->lenbits), state->work);