Commit 2d43e0d3 authored by Adenilson Cavalcanti's avatar Adenilson Cavalcanti Committed by Commit Bot

Properly initialize deflate_state instance

Fix use of uninitialized memory reported by oss-fuzz
(and confirmed by valgrind@aarch64) by properly setting deflate_state
internal member (i.e. s->prev) to a valid value before use.

For details, see:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11360

Bug: 1032721
Change-Id: I6c7b2e87e81b8ccc6c39298fd3c704befd797b96
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2015667
Commit-Queue: Adenilson Cavalcanti <cavalcantii@chromium.org>
Reviewed-by: default avatarChris Blume <cblume@chromium.org>
Reviewed-by: default avatarvikas soni <vikassoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#734278}
parent f11817d3
......@@ -318,6 +318,10 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
s->w_size + window_padding,
2*sizeof(Byte));
s->prev = (Posf *) ZALLOC(strm, s->w_size, sizeof(Pos));
/* Avoid use of uninitialized value, see:
* https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11360
*/
memset(s->prev, 0, s->w_size * sizeof(Pos));
s->head = (Posf *) ZALLOC(strm, s->hash_size, sizeof(Pos));
s->high_water = 0; /* nothing written to s->window yet */
......
diff --git a/third_party/zlib/deflate.c b/third_party/zlib/deflate.c
index a39e62787862..c6053fd1c7ea 100644
--- a/third_party/zlib/deflate.c
+++ b/third_party/zlib/deflate.c
@@ -318,6 +318,10 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
s->w_size + window_padding,
2*sizeof(Byte));
s->prev = (Posf *) ZALLOC(strm, s->w_size, sizeof(Pos));
+ /* Avoid use of uninitialized value, see:
+ * https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11360
+ */
+ memset(s->prev, 0, s->w_size * sizeof(Pos));
s->head = (Posf *) ZALLOC(strm, s->hash_size, sizeof(Pos));
s->high_water = 0; /* nothing written to s->window yet */
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment