Skip to content

Commit 491a17c

Browse files
tabudzmvieth
authored andcommitted
Remove offset pointer optimization in inftrees.c.
inftrees.c was subtracting an offset from a pointer to an array, in order to provide a pointer that allowed indexing starting at the offset. This is not compliant with the C standard, for which the behavior of a pointer decremented before its allocated memory is undefined. Per the recommendation of a security audit of the zlib code by Trail of Bits and TrustInSoft, in support of the Mozilla Foundation, this tiny optimization was removed, in order to avoid the possibility of undefined behavior.
1 parent 9b0a9ea commit 491a17c

1 file changed

Lines changed: 8 additions & 10 deletions

File tree

surface/src/3rdparty/opennurbs/inftrees.c

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ unsigned short FAR *work;
5454
code FAR *next; /* next available space in table */
5555
const unsigned short FAR *base; /* base value table to use */
5656
const unsigned short FAR *extra; /* extra bits table to use */
57-
int end; /* use base and extra for symbol > end */
57+
unsigned match; /* use base and extra for symbol >= match */
5858
unsigned short count[MAXBITS+1]; /* number of codes of each length */
5959
unsigned short offs[MAXBITS+1]; /* offsets in table for each length */
6060
static const unsigned short lbase[31] = { /* Length codes 257..285 base */
@@ -182,19 +182,17 @@ unsigned short FAR *work;
182182
switch (type) {
183183
case CODES:
184184
base = extra = work; /* dummy value--not used */
185-
end = 19;
185+
match = 20;
186186
break;
187187
case LENS:
188188
base = lbase;
189-
base -= 257;
190189
extra = lext;
191-
extra -= 257;
192-
end = 256;
190+
match = 257;
193191
break;
194192
default: /* DISTS */
195193
base = dbase;
196194
extra = dext;
197-
end = -1;
195+
match = 0;
198196
}
199197

200198
/* initialize state for loop */
@@ -216,13 +214,13 @@ unsigned short FAR *work;
216214
for (;;) {
217215
/* create table entry */
218216
this.bits = (unsigned char)(len - drop);
219-
if ((int)(work[sym]) < end) {
217+
if (work[sym] + 1 < match) {
220218
this.op = (unsigned char)0;
221219
this.val = work[sym];
222220
}
223-
else if ((int)(work[sym]) > end) {
224-
this.op = (unsigned char)(extra[work[sym]]);
225-
this.val = base[work[sym]];
221+
else if (work[sym] >= match) {
222+
this.op = (unsigned char)(extra[work[sym] - match]);
223+
this.val = base[work[sym] - match];
226224
}
227225
else {
228226
this.op = (unsigned char)(32 + 64); /* end of block */

0 commit comments

Comments
 (0)