aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorChris D. Faulhaber <jedgar@FreeBSD.org>2002-03-24 23:24:46 +0000
committerChris D. Faulhaber <jedgar@FreeBSD.org>2002-03-24 23:24:46 +0000
commit3ec7cffb4b59b006528b57a564445fb6e56299ee (patch)
treefbd849623e20f71677e7251aeec703d41f918498
parentf965912d94926b0bf48c8da947a2e52bfca5996d (diff)
downloadsrc-3ec7cffb4b59b006528b57a564445fb6e56299ee.tar.gz
src-3ec7cffb4b59b006528b57a564445fb6e56299ee.zip
MFC 1.12: correct bug introduced in 1.11 where ZFREE was moved to a
point after the structural members were clobbered by stores into a union'd structure. MFC 1.13: correct deflate window size check.
Notes
Notes: svn path=/releng/4.3/; revision=93114
-rw-r--r--sys/net/zlib.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/sys/net/zlib.c b/sys/net/zlib.c
index bf1f72dae344..03bf230dd098 100644
--- a/sys/net/zlib.c
+++ b/sys/net/zlib.c
@@ -776,7 +776,7 @@ int deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
windowBits = -windowBits;
}
if (memLevel < 1 || memLevel > MAX_MEM_LEVEL || method != Z_DEFLATED ||
- windowBits < 8 || windowBits > 15 || level < 0 || level > 9 ||
+ windowBits < 9 || windowBits > 15 || level < 0 || level > 9 ||
strategy < 0 || strategy > Z_HUFFMAN_ONLY) {
return Z_STREAM_ERROR;
}
@@ -3951,11 +3951,15 @@ int r;
r = Z_MEM_ERROR;
LEAVE
}
+ /*
+ * this ZFREE must occur *BEFORE* we mess with sub.decode, because
+ * sub.trees is union'd with sub.decode.
+ */
+ ZFREE(z, s->sub.trees.blens);
s->sub.decode.codes = c;
s->sub.decode.tl = tl;
s->sub.decode.td = td;
}
- ZFREE(z, s->sub.trees.blens);
s->mode = CODES;
case CODES:
UPDATE