Index: third_party/brotli/dec/decode.c |
diff --git a/third_party/brotli/dec/decode.c b/third_party/brotli/dec/decode.c |
index 5d4af1d93cd54977e9ef5508b075775cc045dc18..6326c2024295895c1047f5f052d7b2e7d2c16baa 100644 |
--- a/third_party/brotli/dec/decode.c |
+++ b/third_party/brotli/dec/decode.c |
@@ -1700,6 +1700,10 @@ postReadDistance: |
uint8_t* copy_src = &s->ringbuffer[ |
(pos - s->distance_code) & s->ringbuffer_mask]; |
uint8_t* copy_dst = &s->ringbuffer[pos]; |
+ /* Check for possible underflow and clamp the pointer to 0. */ |
+ if (PREDICT_FALSE(s->ringbuffer_end < (const uint8_t*)0 + i)) { |
+ ringbuffer_end_minus_copy_length = 0; |
+ } |
/* update the recent distances cache */ |
s->dist_rb[s->dist_rb_idx & 3] = s->distance_code; |
++s->dist_rb_idx; |