0027-unzip-zipbomb-part1.patch (1020B)
1 From 41beb477c5744bc396fa1162ee0c14218ec12213 Mon Sep 17 00:00:00 2001 2 From: Mark Adler <madler@alumni.caltech.edu> 3 Date: Mon, 27 May 2019 08:20:32 -0700 4 Subject: [PATCH] Fix bug in undefer_input() that misplaced the input state. 5 6 --- 7 fileio.c | 4 +++- 8 1 file changed, 3 insertions(+), 1 deletion(-) 9 10 diff --git a/fileio.c b/fileio.c 11 index c042987..bc00d74 100644 12 --- a/fileio.c 13 +++ b/fileio.c 14 @@ -530,8 +530,10 @@ void undefer_input(__G) 15 * This condition was checked when G.incnt_leftover was set > 0 in 16 * defer_leftover_input(), and it is NOT allowed to touch G.csize 17 * before calling undefer_input() when (G.incnt_leftover > 0) 18 - * (single exception: see read_byte()'s "G.csize <= 0" handling) !! 19 + * (single exception: see readbyte()'s "G.csize <= 0" handling) !! 20 */ 21 + if (G.csize < 0L) 22 + G.csize = 0L; 23 G.incnt = G.incnt_leftover + (int)G.csize; 24 G.inptr = G.inptr_leftover - (int)G.csize; 25 G.incnt_leftover = 0;