Skip to content

Commit

Permalink
Fix another infinite loop similar to the previous one
Browse files Browse the repository at this point in the history
  • Loading branch information
oyvindln committed Jan 28, 2018
1 parent 01a5712 commit 91c23bd
Show file tree
Hide file tree
Showing 3 changed files with 16 additions and 1 deletion.
5 changes: 5 additions & 0 deletions miniz_oxide/src/inflate/core.rs
Original file line number Diff line number Diff line change
Expand Up @@ -547,6 +547,10 @@ where
code_len = res.1 as u32;
};

if code_len == 0 {
return Action::Jump(InvalidCodeLen);
}

l.bit_buf >>= code_len as u32;
l.num_bits -= code_len;
f(r, l, symbol)
Expand Down Expand Up @@ -1077,6 +1081,7 @@ fn decompress_inner(
dist_from_out_buf_start: r.dist_from_out_buf_start,
};


let mut status = 'state_machine: loop {
match state {
Start => {
Expand Down
12 changes: 11 additions & 1 deletion miniz_oxide/tests/test.rs
Original file line number Diff line number Diff line change
Expand Up @@ -31,8 +31,18 @@ fn inf_issue_19() {
let _ = decompress_to_vec(data.as_slice());
}

/// Fuzzed (invalid )file that resulted in an infinite loop as inflate read a code as having 0
/// length.
#[test]
fn decompress_oom() {
fn decompress_zero_code_len_oom() {
let data = get_test_file_data("tests/test_data/invalid_code_len_oom");
let _ = decompress_to_vec(data.as_slice());
}

/// Same problem as previous test but in the end of input huffman decode part of
/// `decode_huffman_code`
#[test]
fn decompress_zero_code_len_2() {
let data = get_test_file_data("tests/test_data/invalid_code_len_oom");
let _ = decompress_to_vec(data.as_slice());
}
Expand Down
Binary file not shown.

0 comments on commit 91c23bd

Please sign in to comment.