[CVE-2016-9840] Remove offset pointer optimization in inftrees.c.

[platform/upstream/libwebsockets.git] / win32port / zlib / inftrees.c

diff --git a/win32port/zlib/inftrees.c b/win32port/zlib/inftrees.c
index 9dbaec3..fbd81d7 100644 (file)
--- a/win32port/zlib/inftrees.c
+++ b/win32port/zlib/inftrees.c
@@ -54,7 +54,7 @@ unsigned short FAR *work;
     code FAR *next;             /* next available space in table */\r
     const unsigned short FAR *base;     /* base value table to use */\r
     const unsigned short FAR *extra;    /* extra bits table to use */\r
-    int end;                    /* use base and extra for symbol > end */\r
+    unsigned match;             /* use base and extra for symbol >= match */\r
     unsigned short count[MAXBITS+1];    /* number of codes of each length */\r
     unsigned short offs[MAXBITS+1];     /* offsets in table for each length */\r
     static const unsigned short lbase[31] = { /* Length codes 257..285 base */\r
@@ -181,19 +181,17 @@ unsigned short FAR *work;
     switch (type) {\r
     case CODES:\r
         base = extra = work;    /* dummy value--not used */\r
-        end = 19;\r
+        match = 20;\r
         break;\r
     case LENS:\r
         base = lbase;\r
-        base -= 257;\r
         extra = lext;\r
-        extra -= 257;\r
-        end = 256;\r
+        match = 257;\r
         break;\r
     default:            /* DISTS */\r
         base = dbase;\r
         extra = dext;\r
-        end = -1;\r
+        match = 0;\r
     }\r
 \r
     /* initialize state for loop */\r
@@ -216,13 +214,13 @@ unsigned short FAR *work;
     for (;;) {\r
         /* create table entry */\r
         here.bits = (unsigned char)(len - drop);\r
-        if ((int)(work[sym]) < end) {\r
+        if (work[sym] + 1 < match) {\r
             here.op = (unsigned char)0;\r
             here.val = work[sym];\r
         }\r
-        else if ((int)(work[sym]) > end) {\r
-            here.op = (unsigned char)(extra[work[sym]]);\r
-            here.val = base[work[sym]];\r
+        else if (work[sym] >= match) {\r
+            here.op = (unsigned char)(extra[work[sym] - match]);\r
+            here.val = base[work[sym] - match];\r
         }\r
         else {\r
             here.op = (unsigned char)(32 + 64);         /* end of block */\r