tree 0d4f56adcaf9880ba2189f88a291cefd2ec93117
parent cbfdeba6609b702432886ecf3e2786818a2bc55b
author Samuel Sapalski <samuel.sapalski@nokia.com> 1614785482 +0100
committer Denys Vlasenko <vda.linux@googlemail.com> 1615542310 +0100

decompress_gunzip: Fix DoS if gzip is corrupt

On certain corrupt gzip files, huft_build will set the error bit on
the result pointer. If afterwards abort_unzip is called huft_free
might run into a segmentation fault or an invalid pointer to
free(p).

In order to mitigate this, we check in huft_free if the error bit
is set and clear it before the linked list is freed.

Signed-off-by: Samuel Sapalski <samuel.sapalski@nokia.com>
Signed-off-by: Peter Kaestle <peter.kaestle@nokia.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>