RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-26 04:07:35 +00:00
Code Issues Activity Actions

LibCompress: Check and fail for input stream errors in DeflateDecompressor

Browse source 
Since we were not checking for error flags set by read_bits we would
just always read 0 as the bits' value, which in some edge cases could
lead to an infinite loop.
This commit is contained in:
Idan Horowitz 2021-03-16 18:28:01 +02:00 • committed by Andreas Kling
parent 46c7f52896
commit be5a8d9c7f
1 changed files with 25 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

25
Userland/Libraries/LibCompress/Deflate.cpp
View file

@ -218,12 +218,22 @@ size_t DeflateDecompressor::read(Bytes bytes)
m_read_final_bock = m_input_stream.read_bit(); m_read_final_bock = m_input_stream.read_bit();
const auto block_type = m_input_stream.read_bits(2); const auto block_type = m_input_stream.read_bits(2);
if (m_input_stream.has_any_error()) {
set_fatal_error();
return 0;
}
if (block_type == 0b00) { if (block_type == 0b00) {
m_input_stream.align_to_byte_boundary(); m_input_stream.align_to_byte_boundary();
LittleEndian<u16> length, negated_length; LittleEndian<u16> length, negated_length;
m_input_stream >> length >> negated_length; m_input_stream >> length >> negated_length;
if (m_input_stream.has_any_error()) {
set_fatal_error();
return 0;
}
if ((length ^ 0xffff) != negated_length) { if ((length ^ 0xffff) != negated_length) {
set_fatal_error(); set_fatal_error();
return 0; return 0;
@ -247,6 +257,11 @@ size_t DeflateDecompressor::read(Bytes bytes)
Optional<CanonicalCode> distance_codes; Optional<CanonicalCode> distance_codes;
decode_codes(literal_codes, distance_codes); decode_codes(literal_codes, distance_codes);
if (m_input_stream.has_any_error()) {
set_fatal_error();
return 0;
}
m_state = State::ReadingCompressedBlock; m_state = State::ReadingCompressedBlock;
new (&m_compressed_block) CompressedBlock(*this, literal_codes, distance_codes); new (&m_compressed_block) CompressedBlock(*this, literal_codes, distance_codes);
@ -264,6 +279,11 @@ size_t DeflateDecompressor::read(Bytes bytes)
nread += m_output_stream.read(bytes.slice(nread)); nread += m_output_stream.read(bytes.slice(nread));
} }
if (m_input_stream.has_any_error()) {
set_fatal_error();
return 0;
}
if (nread == bytes.size()) if (nread == bytes.size())
return nread; return nread;
@ -280,6 +300,11 @@ size_t DeflateDecompressor::read(Bytes bytes)
nread += m_output_stream.read(bytes.slice(nread)); nread += m_output_stream.read(bytes.slice(nread));
} }
if (m_input_stream.has_any_error()) {
set_fatal_error();
return 0;
}
if (nread == bytes.size()) if (nread == bytes.size())
return nread; return nread;