Bommels05/Mozilla
Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix zlib double-free crash (bug 126898) contributed by mjc@redhat.com, r=dveditz, sr=shaver, a=asa

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@115667 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
dveditz%netscape.com 2002-03-03 06:32:46 +00:00
parent 7d59ac43e4
commit 402dfd533d
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
mozilla/modules/zlib/src/infblock.c
View File

@ -249,10 +249,12 @@ int r;
&s->sub.trees.tb, s->hufts, z);
if (t != Z_OK)
{
ZFREE(z, s->sub.trees.blens);
r = t;
if (r == Z_DATA_ERROR)
{
ZFREE(z, s->sub.trees.blens);
s->mode = BAD;
}
LEAVE
}
s->sub.trees.index = 0;
@ -313,14 +315,17 @@ int r;
t = inflate_trees_dynamic(257 + (t & 0x1f), 1 + ((t >> 5) & 0x1f),
s->sub.trees.blens, &bl, &bd, &tl, &td,
s->hufts, z);
ZFREE(z, s->sub.trees.blens);
if (t != Z_OK)
{
if (t == (uInt)Z_DATA_ERROR)
{
ZFREE(z, s->sub.trees.blens);
s->mode = BAD;
}
r = t;
LEAVE
}
ZFREE(z, s->sub.trees.blens);
Tracev((stderr, "inflate: trees ok\n"));
if ((c = inflate_codes_new(bl, bd, tl, td, z)) == Z_NULL)
{