zlib: handle overflow while calculating available stream input size

[karo-tx-uboot.git] / lib / zlib / inffast.c

diff --git a/lib/zlib/inffast.c b/lib/zlib/inffast.c
index 8e823df4cf158bc0e2e23d9b15c5914c68d5d472..4834b0c86e00c3d4e6f0f217fa1d9f8f0dbdd5a0 100644 (file)
--- a/lib/zlib/inffast.c
+++ b/lib/zlib/inffast.c
@@ -100,6 +100,14 @@ unsigned start;         /* inflate()'s starting value for strm->avail_out */
     state = (struct inflate_state FAR *)strm->state;
     in = strm->next_in - OFF;
     last = in + (strm->avail_in - 5);
+    if (in > last && strm->avail_in > 5) {
+        /*
+         * overflow detected, limit strm->avail_in to the
+         * max. possible size and recalculate last
+         */
+        strm->avail_in = 0xffffffff - (unsigned int)in;
+        last = in + (strm->avail_in - 5);
+    }
     out = strm->next_out - OFF;
     beg = out - (start - strm->avail_out);
     end = out + (strm->avail_out - 257);