[CVE-2016-9841] Use post-increment only in inffast.c. 42/253442/1 sandbox/backup/ccache_3.1.6_20210820 accepted/tizen/base/20210215.225334 submit/tizen_base/20210210.053258 submit/tizen_base/20210216.123456
authorMark Adler <madler@alumni.caltech.edu>
Thu, 22 Sep 2016 05:25:21 +0000 (22:25 -0700)
committerDongHun Kwak <dh0128.kwak@samsung.com>
Wed, 10 Feb 2021 05:25:38 +0000 (14:25 +0900)
commit08e5640856482431b48e016020d190dd7e466e35
treecffc30a58ec576ad6494a4bfcbd7af8748fccd6f
parent6d7df5b1c0e3c46f82b48b57a0019bb94f95d126
[CVE-2016-9841] Use post-increment only in inffast.c.

An old inffast.c optimization turns out to not be optimal anymore
with modern compilers, and furthermore was not compliant with the
C standard, for which decrementing a pointer before its allocated
memory is undefined. Per the recommendation of a security audit of
the zlib code by Trail of Bits and TrustInSoft, in support of the
Mozilla Foundation, this "optimization" was removed, in order to
avoid the possibility of undefined behavior.

Change-Id: I67a6b30ca182d5286adcfa5ab7395eed6679ae01
Signed-off-by: DongHun Kwak <dh0128.kwak@samsung.com>
zlib/inffast.c