| Index: net/websockets/websocket_inflater.cc
|
| diff --git a/net/websockets/websocket_inflater.cc b/net/websockets/websocket_inflater.cc
|
| index 7767821f462bf7a292ed09664cf925d3a0422cbb..91ed7477bebd38c9908e7770c9ad9a639ae3f02e 100644
|
| --- a/net/websockets/websocket_inflater.cc
|
| +++ b/net/websockets/websocket_inflater.cc
|
| @@ -47,9 +47,19 @@ WebSocketInflater::WebSocketInflater(size_t input_queue_capacity,
|
| bool WebSocketInflater::Initialize(int window_bits) {
|
| DCHECK_LE(8, window_bits);
|
| DCHECK_GE(15, window_bits);
|
| +
|
| + // Use a negative value to decompress a raw deflate stream. Upgrade
|
| + // window_bits = 8 (a 256-byte window) to 9 (a 512-byte window) because zlib
|
| + // is unable to compress using a 256-byte window. Historically, zlib has
|
| + // silently increased the window size during compression in this case. This
|
| + // must also be done during decompression to avoid inadvertently attempting
|
| + // decompression with a window smaller than what zlib actually would have used
|
| + // during compression. See https://crbug.com/691074.
|
| + window_bits = -std::max(window_bits, 9);
|
| +
|
| stream_.reset(new z_stream);
|
| memset(stream_.get(), 0, sizeof(*stream_));
|
| - int result = inflateInit2(stream_.get(), -window_bits);
|
| + int result = inflateInit2(stream_.get(), window_bits);
|
| if (result != Z_OK) {
|
| inflateEnd(stream_.get());
|
| stream_.reset();
|
|
|