Commit 12d7b90 for zlib

commit 12d7b90980910fcd7713e58cedcca046acb5a55f
Author: ronald.eytchison@trailofbits.com <ronald.eytchison@trailofbits.com>
Date:   Fri Jun 5 19:10:15 2026 +0000

    Check deflatePrime pending capacity.

    Repeated calls of deflatePrime() with no intervening deflate()
    could write past the end of pending_buf. Check the bytes that will
    be written against the space remaining, moving pending output as
    needed.

    Reported by Trail of Bits (TOB-ZLIB-013).

diff --git a/deflate.c b/deflate.c
index fd83075..cdb087d 100644
--- a/deflate.c
+++ b/deflate.c
@@ -746,18 +746,23 @@ int ZEXPORT deflateUsed(z_streamp strm, int *bits) {
 int ZEXPORT deflatePrime(z_streamp strm, int bits, int value) {
     deflate_state *s;
     int put;
+    int need;

     if (deflateStateCheck(strm)) return Z_STREAM_ERROR;
     s = strm->state;
-#ifdef LIT_MEM
-    if (bits < 0 || bits > 16 ||
-        (uchf *)s->d_buf < s->pending_out + ((Buf_size + 7) >> 3))
+    if (bits < 0 || bits > 16)
         return Z_BUF_ERROR;
-#else
-    if (bits < 0 || bits > 16 ||
-        s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
+    if (s->pending_out != s->pending_buf) {
+        /* move partially flushed pending output to buffer start */
+        Bytef *to = s->pending_buf, *from = s->pending_out;
+        ulg n = s->pending;
+        while (n--)
+            *to++ = *from++;
+        s->pending_out = s->pending_buf;
+    }
+    need = (s->bi_valid + bits) >> 3;
+    if (s->pending_buf_size - s->pending < (ulg)need)
         return Z_BUF_ERROR;
-#endif
     do {
         put = Buf_size - s->bi_valid;
         if (put > bits)