[CVE-2016-9841] Use post-increment only in inffast.c. 46/272046/1 accepted/tizen/unified/20220325.133352 submit/tizen/20220324.105704
authorSeonah Moon <seonah1.moon@samsung.com>
Mon, 7 Mar 2022 10:28:50 +0000 (19:28 +0900)
committerSeonah Moon <seonah1.moon@samsung.com>
Mon, 7 Mar 2022 10:28:54 +0000 (19:28 +0900)
commitb651ab7fd6ce59a3411320e40913e38bc0cfc413
treed49e8c1ff1b3ff50b972bc8d889d841cf01e0fb6
parent66326afdeb10bedeadecb52b3bc7fe188434f70f
[CVE-2016-9841] Use post-increment only in inffast.c.

An old inffast.c optimization turns out to not be optimal anymore
with modern compilers, and furthermore was not compliant with the
C standard, for which decrementing a pointer before its allocated
memory is undefined. Per the recommendation of a security audit of
the zlib code by Trail of Bits and TrustInSoft, in support of the
Mozilla Foundation, this "optimization" was removed, in order to
avoid the possibility of undefined behavior.

Change-Id: Icb226a05cd35504c8867bb37bbb79f46340f72e8
win32port/zlib/inffast.c