Merge pull request #329 from iibclothier/master

Remedy CVE-2018-12913
richgel999 · Dec 29, 2024 · 0c30a00 · 0c30a00
2 parents 2fa13ca + 8980137
commit 0c30a00
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/.github/workflows/ci-fuzz.yml b/.github/workflows/ci-fuzz.yml
@@ -16,8 +16,8 @@ jobs:
         fuzz-seconds: 900
         dry-run: false
     - name: Upload Crash
-      uses: actions/upload-artifact@v1
+      uses: actions/upload-artifact@v4
       if: failure()
       with:
         name: artifacts
-        path: ./out/artifacts
+        path: ./out/artifacts
diff --git a/miniz_tinfl.c b/miniz_tinfl.c
@@ -490,6 +490,12 @@ extern "C"
                             }
                             bit_buf >>= code_len;
                             num_bits -= code_len;
+
+                        /* assert(sym2 != 0 && counter != 0); */
+                        if (sym2 == 0 && counter == 0)
+                        {
+                            TINFL_CR_RETURN_FOREVER(40, TINFL_STATUS_FAILED);
+                        }
 
                             pOut_buf_cur[0] = (mz_uint8)counter;
                             if (sym2 & 256)