31 lines
1.3 KiB
Diff
31 lines
1.3 KiB
Diff
From fa03b567552ecc1a2a91850c959220ab28f178dd Mon Sep 17 00:00:00 2001
|
|
From: yangyudong <yangyudong3@huawei.com>
|
|
Date: Fri, 21 Oct 2022 12:02:55 +0800
|
|
Subject: cve-2022-37434: Fix a bug when getting a gzip header extra
|
|
field with inflate().
|
|
|
|
Bug url: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-37434
|
|
---
|
|
jdk/src/share/native/java/util/zip/zlib/inflate.c | 5 +++--
|
|
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/jdk/src/share/native/java/util/zip/zlib/inflate.c b/jdk/src/share/native/java/util/zip/zlib/inflate.c
|
|
index ca904e744..63decdb19 100644
|
|
--- a/jdk/src/share/native/java/util/zip/zlib/inflate.c
|
|
+++ b/jdk/src/share/native/java/util/zip/zlib/inflate.c
|
|
@@ -783,8 +783,9 @@ int flush;
|
|
if (copy > have) copy = have;
|
|
if (copy) {
|
|
if (state->head != Z_NULL &&
|
|
- state->head->extra != Z_NULL) {
|
|
- len = state->head->extra_len - state->length;
|
|
+ state->head->extra != Z_NULL &&
|
|
+ (len = state->head->extra_len - state->length) <
|
|
+ state->head->extra_max) {
|
|
zmemcpy(state->head->extra + len, next,
|
|
len + copy > state->head->extra_max ?
|
|
state->head->extra_max - len : copy);
|
|
--
|
|
2.22.0
|
|
|