qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-25 06:37:58 -07:00
Code Releases Activity

compress/flate: Fixed two panics on bad data

Browse Source 
I used just enough of the data provided by Matt in Issue 5915 to trigger
issue 5915. As luck would have it, using slightly less of it triggered
issue 5962.

Fixes #5915.
Fixes #5962.

R=golang-dev, bradfitz
CC=golang-dev
https://golang.org/cl/12288043
This commit is contained in:
Pieter Droogendijk 2013-08-01 15:20:01 -07:00 committed by Brad Fitzpatrick
parent 17d803d251
commit df1eeeba4a
2 changed files with 31 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
src/pkg/compress/flate/flate_test.go
View File

@ -24,3 +24,26 @@ func TestUncompressedSource(t *testing.T) {
t.Errorf("output[0] = %x, want 0x11", output[0])
}
}
// The following test should not panic.
func TestIssue5915(t *testing.T) {
bits := []int{4, 0, 0, 6, 4, 3, 2, 3, 3, 4, 4, 5, 0, 0, 0, 0, 5, 5, 6,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 11, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 7, 8, 6, 0, 11, 0, 8, 0, 6, 6, 10, 8}
h := new(huffmanDecoder)
ok := h.init(bits)
if ok == true {
t.Fatalf("Given sequence of bits is bad, and should not succeed.")
}
}
// The following test should not panic.
func TestIssue5962(t *testing.T) {
bits := []int{4, 0, 0, 6, 4, 3, 2, 3, 3, 4, 4, 5, 0, 0, 0, 0,
5, 5, 6, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 11}
h := new(huffmanDecoder)
ok := h.init(bits)
if ok == true {
t.Fatalf("Given sequence of bits is bad, and should not succeed.")
}
}

9
src/pkg/compress/flate/inflate.go
View File

@ -125,6 +125,9 @@ func (h *huffmanDecoder) init(bits []int) bool {
if i == huffmanChunkBits+1 {
// create link tables
link := code >> 1
if huffmanNumChunks < link {
return false
}
h.links = make([][]uint32, huffmanNumChunks-link)
for j := uint(link); j < huffmanNumChunks; j++ {
reverse := int(reverseByte[j>>8]) | int(reverseByte[j&0xff])<<8
@ -154,7 +157,11 @@ func (h *huffmanDecoder) init(bits []int) bool {
h.chunks[off] = chunk
}
} else {
linktab := h.links[h.chunks[reverse&(huffmanNumChunks-1)]>>huffmanValueShift]
value := h.chunks[reverse&(huffmanNumChunks-1)] >> huffmanValueShift
if value >= uint32(len(h.links)) {
return false
}
linktab := h.links[value]
reverse >>= huffmanChunkBits
for off := reverse; off < numLinks; off += 1 << uint(n-huffmanChunkBits) {
linktab[off] = chunk