Commit ba829a4 for zlib
commit ba829a458576d1ff0f26fc7230c6de816d1f6a77
Author: Mark Adler <git@madler.net>
Date: Sun Dec 21 18:17:56 2025 -0800
Check for negative lengths in crc32_combine functions.
Though zlib.h says that len2 must be non-negative, this avoids the
possibility of an accidental infinite loop.
diff --git a/crc32.c b/crc32.c
index 6c38f5c..33d8c79 100644
--- a/crc32.c
+++ b/crc32.c
@@ -1019,6 +1019,8 @@ unsigned long ZEXPORT crc32(unsigned long crc, const unsigned char FAR *buf,
/* ========================================================================= */
uLong ZEXPORT crc32_combine64(uLong crc1, uLong crc2, z_off64_t len2) {
+ if (len2 < 0)
+ return 0;
#ifdef DYNAMIC_CRC_TABLE
once(&made, make_crc_table);
#endif /* DYNAMIC_CRC_TABLE */
@@ -1032,6 +1034,8 @@ uLong ZEXPORT crc32_combine(uLong crc1, uLong crc2, z_off_t len2) {
/* ========================================================================= */
uLong ZEXPORT crc32_combine_gen64(z_off64_t len2) {
+ if (len2 < 0)
+ return 0;
#ifdef DYNAMIC_CRC_TABLE
once(&made, make_crc_table);
#endif /* DYNAMIC_CRC_TABLE */
diff --git a/zlib.h b/zlib.h
index f7aded9..2881da7 100644
--- a/zlib.h
+++ b/zlib.h
@@ -1848,14 +1848,14 @@ ZEXTERN uLong ZEXPORT crc32_combine(uLong crc1, uLong crc2, z_off_t len2);
seq1 and seq2 with lengths len1 and len2, CRC-32 check values were
calculated for each, crc1 and crc2. crc32_combine() returns the CRC-32
check value of seq1 and seq2 concatenated, requiring only crc1, crc2, and
- len2. len2 must be non-negative.
+ len2. len2 must be non-negative, otherwise zero is returned.
*/
/*
ZEXTERN uLong ZEXPORT crc32_combine_gen(z_off_t len2);
Return the operator corresponding to length len2, to be used with
- crc32_combine_op(). len2 must be non-negative.
+ crc32_combine_op(). len2 must be non-negative, otherwise zero is returned.
*/
ZEXTERN uLong ZEXPORT crc32_combine_op(uLong crc1, uLong crc2, uLong op);