AP_ROMFS: fixed error handling in tinflate

coverity CID308327
This commit is contained in:
Andrew Tridgell 2018-08-07 12:10:14 +10:00
parent 4aff747b28
commit d1334fab73
1 changed files with 6 additions and 0 deletions

View File

@ -328,6 +328,9 @@ static int tinf_decode_trees(TINF_DATA *d, TINF_TREE *lt, TINF_TREE *dt)
switch (sym)
{
case 16:
if (num == 0) {
return TINF_DATA_ERROR;
}
/* copy previous code length 3-6 times (read 2 bits) */
fill_value = lengths[num - 1];
lbits = 2;
@ -398,6 +401,9 @@ static int tinf_inflate_block_data(TINF_DATA *d, TINF_TREE *lt, TINF_TREE *dt)
d->curlen = tinf_read_bits(d, length_bits[sym], length_base[sym]);
dist = tinf_decode_symbol(d, dt);
if (dist < 0) {
return dist;
}
/* possibly get more bits from distance code */
offs = tinf_read_bits(d, dist_bits[dist], dist_base[dist]);
if (d->dict_ring) {