Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(7)

Unified Diff: third_party/brotli/dec/decode.c

Issue 1662313002: Cherry pick underflow fix. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 4 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « third_party/brotli/README.chromium ('k') | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: third_party/brotli/dec/decode.c
diff --git a/third_party/brotli/dec/decode.c b/third_party/brotli/dec/decode.c
index 5d4af1d93cd54977e9ef5508b075775cc045dc18..6326c2024295895c1047f5f052d7b2e7d2c16baa 100644
--- a/third_party/brotli/dec/decode.c
+++ b/third_party/brotli/dec/decode.c
@@ -1700,6 +1700,10 @@ postReadDistance:
uint8_t* copy_src = &s->ringbuffer[
(pos - s->distance_code) & s->ringbuffer_mask];
uint8_t* copy_dst = &s->ringbuffer[pos];
+ /* Check for possible underflow and clamp the pointer to 0. */
+ if (PREDICT_FALSE(s->ringbuffer_end < (const uint8_t*)0 + i)) {
+ ringbuffer_end_minus_copy_length = 0;
+ }
/* update the recent distances cache */
s->dist_rb[s->dist_rb_idx & 3] = s->distance_code;
++s->dist_rb_idx;
« no previous file with comments | « third_party/brotli/README.chromium ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698