Commit e7bb978 for zlib
commit e7bb9788e0f0e9252de04fc52c3ada4ddede2f7d
Author: ronald.eytchison@trailofbits.com <ronald.eytchison@trailofbits.com>
Date: Fri Jun 5 19:10:15 2026 +0000
Keep primed inflate streams off of the fast path.
After inflatePrime(), inflate() could use inflate_fast() with more
bits buffered than it allows. That could leave next_in pointing
before the start of the input buffer, so that the next inflate()
call would read out of bounds. Use the slow path until fewer than
eight bits remain.
Reported by Trail of Bits (TOB-ZLIB-014).
diff --git a/inflate.c b/inflate.c
index 5f8b93c..2cbf719 100644
--- a/inflate.c
+++ b/inflate.c
@@ -920,7 +920,7 @@ int ZEXPORT inflate(z_streamp strm, int flush) {
state->mode = LEN;
/* fallthrough */
case LEN:
- if (have >= 6 && left >= 258) {
+ if (have >= 6 && left >= 258 && bits < 8) {
RESTORE();
inflate_fast(strm, out);
LOAD();