Skip to content

Potential Vulnerability in Cloned Code #109

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ivanaclairineirsan wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Potential Vulnerability in Cloned Code #109

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e9e50fe
Avoid pre-decrement of pointer in big-endian CRC calculation.
Dec 17, 2025
3fe27c6
Remove offset pointer optimization in inftrees.c.
Dec 17, 2025
5f698b1
Use post-increment only in inffast.c
Dec 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions Projects/32L4P5GDISCOVERY/Demonstrations/Watermark/lib/zlib-1.2.8/crc32.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -285,7 +285,7 @@ local unsigned long crc32_little(crc, buf, len)
}

/* ========================================================================= */
#define DOBIG4 c ^= *++buf4; \
#define DOBIG4 c ^= *buf4++; \
c = crc_table[4][c & 0xff] ^ crc_table[5][(c >> 8) & 0xff] ^ \
crc_table[6][(c >> 16) & 0xff] ^ crc_table[7][c >> 24]
#define DOBIG32 DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4; DOBIG4
Expand All @@ -307,7 +307,6 @@ local unsigned long crc32_big(crc, buf, len)
}

buf4 = (const z_crc_t FAR *)(const void FAR *)buf;
buf4--;
while (len >= 32) {
DOBIG32;
len -= 32;
Expand All @@ -316,7 +315,6 @@ local unsigned long crc32_big(crc, buf, len)
DOBIG4;
len -= 4;
}
buf4++;
buf = (const unsigned char FAR *)buf4;

if (len) do {
Expand Down
81 changes: 31 additions & 50 deletions Projects/32L4P5GDISCOVERY/Demonstrations/Watermark/lib/zlib-1.2.8/inffast.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,25 +10,6 @@

#ifndef ASMINF

/* Allow machine dependent optimization for post-increment or pre-increment.
Based on testing to date,
Pre-increment preferred for:
- PowerPC G3 (Adler)
- MIPS R5000 (Randers-Pehrson)
Post-increment preferred for:
- none
No measurable difference:
- Pentium III (Anderson)
- M68060 (Nikl)
*/
#ifdef POSTINC
# define OFF 0
# define PUP(a) *(a)++
#else
# define OFF 1
# define PUP(a) *++(a)
#endif

/*
Decode literal, length, and distance codes and write out the resulting
literal and match bytes until either not enough input or output is
Expand Down Expand Up @@ -96,9 +77,9 @@ unsigned start; /* inflate()'s starting value for strm->avail_out */

/* copy state to local variables */
state = (struct inflate_state FAR *)strm->state;
in = strm->next_in - OFF;
in = strm->next_in;
last = in + (strm->avail_in - 5);
out = strm->next_out - OFF;
out = strm->next_out;
beg = out - (start - strm->avail_out);
end = out + (strm->avail_out - 257);
#ifdef INFLATE_STRICT
Expand All @@ -119,9 +100,9 @@ unsigned start; /* inflate()'s starting value for strm->avail_out */
input data or output space */
do {
if (bits < 15) {
hold += (unsigned long)(PUP(in)) << bits;
hold += (unsigned long)(*in++) << bits;
bits += 8;
hold += (unsigned long)(PUP(in)) << bits;
hold += (unsigned long)(*in++) << bits;
bits += 8;
}
here = lcode[hold & lmask];
Expand All @@ -134,14 +115,14 @@ unsigned start; /* inflate()'s starting value for strm->avail_out */
Tracevv((stderr, here.val >= 0x20 && here.val < 0x7f ?
"inflate: literal '%c'\n" :
"inflate: literal 0x%02x\n", here.val));
PUP(out) = (unsigned char)(here.val);
*out++ = (unsigned char)(here.val);
}
else if (op & 16) { /* length base */
len = (unsigned)(here.val);
op &= 15; /* number of extra bits */
if (op) {
if (bits < op) {
hold += (unsigned long)(PUP(in)) << bits;
hold += (unsigned long)(*in++) << bits;
bits += 8;
}
len += (unsigned)hold & ((1U << op) - 1);
Expand All @@ -150,9 +131,9 @@ unsigned start; /* inflate()'s starting value for strm->avail_out */
}
Tracevv((stderr, "inflate: length %u\n", len));
if (bits < 15) {
hold += (unsigned long)(PUP(in)) << bits;
hold += (unsigned long)(*in++) << bits;
bits += 8;
hold += (unsigned long)(PUP(in)) << bits;
hold += (unsigned long)(*in++) << bits;
bits += 8;
}
here = dcode[hold & dmask];
Expand All @@ -165,10 +146,10 @@ unsigned start; /* inflate()'s starting value for strm->avail_out */
dist = (unsigned)(here.val);
op &= 15; /* number of extra bits */
if (bits < op) {
hold += (unsigned long)(PUP(in)) << bits;
hold += (unsigned long)(*in++) << bits;
bits += 8;
if (bits < op) {
hold += (unsigned long)(PUP(in)) << bits;
hold += (unsigned long)(*in++) << bits;
bits += 8;
}
}
Expand Down Expand Up @@ -196,30 +177,30 @@ unsigned start; /* inflate()'s starting value for strm->avail_out */
#ifdef INFLATE_ALLOW_INVALID_DISTANCE_TOOFAR_ARRR
if (len <= op - whave) {
do {
PUP(out) = 0;
*out++ = 0;
} while (--len);
continue;
}
len -= op - whave;
do {
PUP(out) = 0;
*out++ = 0;
} while (--op > whave);
if (op == 0) {
from = out - dist;
do {
PUP(out) = PUP(from);
*out++ = *from++;
} while (--len);
continue;
}
#endif
}
from = window - OFF;
from = window;
if (wnext == 0) { /* very common case */
from += wsize - op;
if (op < len) { /* some from window */
len -= op;
do {
PUP(out) = PUP(from);
*out++ = *from++;
} while (--op);
from = out - dist; /* rest from output */
}
Expand All @@ -230,14 +211,14 @@ unsigned start; /* inflate()'s starting value for strm->avail_out */
if (op < len) { /* some from end of window */
len -= op;
do {
PUP(out) = PUP(from);
*out++ = *from++;
} while (--op);
from = window - OFF;
from = window;
if (wnext < len) { /* some from start of window */
op = wnext;
len -= op;
do {
PUP(out) = PUP(from);
*out++ = *from++;
} while (--op);
from = out - dist; /* rest from output */
}
Expand All @@ -248,35 +229,35 @@ unsigned start; /* inflate()'s starting value for strm->avail_out */
if (op < len) { /* some from window */
len -= op;
do {
PUP(out) = PUP(from);
*out++ = *from++;
} while (--op);
from = out - dist; /* rest from output */
}
}
while (len > 2) {
PUP(out) = PUP(from);
PUP(out) = PUP(from);
PUP(out) = PUP(from);
*out++ = *from++;
*out++ = *from++;
*out++ = *from++;
len -= 3;
}
if (len) {
PUP(out) = PUP(from);
*out++ = *from++;
if (len > 1)
PUP(out) = PUP(from);
*out++ = *from++;
}
}
else {
from = out - dist; /* copy direct from output */
do { /* minimum length is three */
PUP(out) = PUP(from);
PUP(out) = PUP(from);
PUP(out) = PUP(from);
*out++ = *from++;
*out++ = *from++;
*out++ = *from++;
len -= 3;
} while (len > 2);
if (len) {
PUP(out) = PUP(from);
*out++ = *from++;
if (len > 1)
PUP(out) = PUP(from);
*out++ = *from++;
}
}
}
Expand Down Expand Up @@ -313,8 +294,8 @@ unsigned start; /* inflate()'s starting value for strm->avail_out */
hold &= (1U << bits) - 1;

/* update state and return */
strm->next_in = in + OFF;
strm->next_out = out + OFF;
strm->next_in = in;
strm->next_out = out;
strm->avail_in = (unsigned)(in < last ? 5 + (last - in) : 5 - (in - last));
strm->avail_out = (unsigned)(out < end ?
257 + (end - out) : 257 - (out - end));
Expand Down
19 changes: 8 additions & 11 deletions Projects/32L4P5GDISCOVERY/Demonstrations/Watermark/lib/zlib-1.2.8/inftrees.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ int ZLIB_INTERNAL inflate_table(codetype type, unsigned short FAR *lens, unsigne
code FAR *next; /* next available space in table */
const unsigned short FAR *base; /* base value table to use */
const unsigned short FAR *extra; /* extra bits table to use */
int end; /* use base and extra for symbol > end */
unsigned match; /* use base and extra for symbol >= match */
unsigned short count[MAXBITS+1]; /* number of codes of each length */
unsigned short offs[MAXBITS+1]; /* offsets in table for each length */
static const unsigned short lbase[31] = { /* Length codes 257..285 base */
Expand Down Expand Up @@ -185,19 +185,17 @@ int ZLIB_INTERNAL inflate_table(codetype type, unsigned short FAR *lens, unsigne
switch (type) {
case CODES:
base = extra = work; /* dummy value--not used */
end = 19;
match = 20;
break;
case LENS:
base = lbase;
base -= 257;
extra = lext;
extra -= 257;
end = 256;
match = 257;
break;
default: /* DISTS */
base = dbase;
extra = dext;
end = -1;
match = 0;
}

/* initialize state for loop */
Expand All @@ -220,14 +218,13 @@ int ZLIB_INTERNAL inflate_table(codetype type, unsigned short FAR *lens, unsigne
for (;;) {
/* create table entry */
here.bits = (unsigned char)(len - drop);
if ((int)(work[sym]) < end) {
if (work[sym] + 1 < match) {
here.op = (unsigned char)0;
here.val = work[sym];
}
else if ((int)(work[sym]) > end) {
here.op = (unsigned char)(extra[work[sym]]);
here.val = base[work[sym]];
}
else if (work[sym] >= match) {
here.op = (unsigned char)(extra[work[sym] - match]);
here.val = base[work[sym] - match];
else {
here.op = (unsigned char)(32 + 64); /* end of block */
here.val = 0;
Expand Down