diff options
| author | Andrey Nazarov <skuller@skuller.net> | 2013-02-06 14:06:02 +0400 |
|---|---|---|
| committer | Andrey Nazarov <skuller@skuller.net> | 2013-02-06 15:05:35 +0400 |
| commit | c10c7d64a8f047d3b9bbcc1f36cf17b4a3bb693e (patch) | |
| tree | f3356ddd2ac2616bc16153facc5eaf22910a8ab6 /src | |
| parent | 554995ad3a61688f698f653d9cb3bef117973382 (diff) | |
Don't allow inflateInit2() access download data.
It was a bad idea to allow since corrupted input could result in fatal
error.
Diffstat (limited to 'src')
| -rw-r--r-- | src/client/download.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/client/download.c b/src/client/download.c index 9f5e97d..d521d01 100644 --- a/src/client/download.c +++ b/src/client/download.c @@ -368,13 +368,13 @@ static int inflate_udp_download(byte *data, int inlen, int outlen) byte buffer[CHUNK]; int ret; - z->next_in = data; - z->avail_in = inlen; - // initialize stream if not done yet if (z->state == NULL && inflateInit2(z, -MAX_WBITS) != Z_OK) Com_Error(ERR_FATAL, "%s: inflateInit2() failed", __func__); + z->next_in = data; + z->avail_in = inlen; + // run inflate() until output buffer not full do { z->next_out = buffer; |