| Index: third_party/brotli/dec/decode.c
|
| diff --git a/third_party/brotli/dec/decode.c b/third_party/brotli/dec/decode.c
|
| index 5d4af1d93cd54977e9ef5508b075775cc045dc18..6326c2024295895c1047f5f052d7b2e7d2c16baa 100644
|
| --- a/third_party/brotli/dec/decode.c
|
| +++ b/third_party/brotli/dec/decode.c
|
| @@ -1700,6 +1700,10 @@ postReadDistance:
|
| uint8_t* copy_src = &s->ringbuffer[
|
| (pos - s->distance_code) & s->ringbuffer_mask];
|
| uint8_t* copy_dst = &s->ringbuffer[pos];
|
| + /* Check for possible underflow and clamp the pointer to 0. */
|
| + if (PREDICT_FALSE(s->ringbuffer_end < (const uint8_t*)0 + i)) {
|
| + ringbuffer_end_minus_copy_length = 0;
|
| + }
|
| /* update the recent distances cache */
|
| s->dist_rb[s->dist_rb_idx & 3] = s->distance_code;
|
| ++s->dist_rb_idx;
|
|
|