Index: net/websockets/websocket_inflater.cc |
diff --git a/net/websockets/websocket_inflater.cc b/net/websockets/websocket_inflater.cc |
index 7767821f462bf7a292ed09664cf925d3a0422cbb..91ed7477bebd38c9908e7770c9ad9a639ae3f02e 100644 |
--- a/net/websockets/websocket_inflater.cc |
+++ b/net/websockets/websocket_inflater.cc |
@@ -47,9 +47,19 @@ WebSocketInflater::WebSocketInflater(size_t input_queue_capacity, |
bool WebSocketInflater::Initialize(int window_bits) { |
DCHECK_LE(8, window_bits); |
DCHECK_GE(15, window_bits); |
+ |
+ // Use a negative value to decompress a raw deflate stream. Upgrade |
+ // window_bits = 8 (a 256-byte window) to 9 (a 512-byte window) because zlib |
+ // is unable to compress using a 256-byte window. Historically, zlib has |
+ // silently increased the window size during compression in this case. This |
+ // must also be done during decompression to avoid inadvertently attempting |
+ // decompression with a window smaller than what zlib actually would have used |
+ // during compression. See https://crbug.com/691074. |
+ window_bits = -std::max(window_bits, 9); |
+ |
stream_.reset(new z_stream); |
memset(stream_.get(), 0, sizeof(*stream_)); |
- int result = inflateInit2(stream_.get(), -window_bits); |
+ int result = inflateInit2(stream_.get(), window_bits); |
if (result != Z_OK) { |
inflateEnd(stream_.get()); |
stream_.reset(); |