Mirror
/
ardupilot
mirror of https://github.com/ArduPilot/ardupilot
5
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

AP_ROMFS: fixed error handling in tinflate 

coverity CID308327
This commit is contained in:
Andrew Tridgell 2018-08-07 12:10:14 +10:00
parent 4aff747b28
commit d1334fab73
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libraries/AP_ROMFS/tinflate.cpp
View File

@ -328,6 +328,9 @@ static int tinf_decode_trees(TINF_DATA *d, TINF_TREE *lt, TINF_TREE *dt)
switch (sym) switch (sym)
{ {
case 16: case 16:
if (num == 0) {
return TINF_DATA_ERROR;
}
/* copy previous code length 3-6 times (read 2 bits) */ /* copy previous code length 3-6 times (read 2 bits) */
fill_value = lengths[num - 1]; fill_value = lengths[num - 1];
lbits = 2; lbits = 2;
@ -398,6 +401,9 @@ static int tinf_inflate_block_data(TINF_DATA *d, TINF_TREE *lt, TINF_TREE *dt)
d->curlen = tinf_read_bits(d, length_bits[sym], length_base[sym]); d->curlen = tinf_read_bits(d, length_bits[sym], length_base[sym]);
dist = tinf_decode_symbol(d, dt); dist = tinf_decode_symbol(d, dt);
if (dist < 0) {
return dist;
}
/* possibly get more bits from distance code */ /* possibly get more bits from distance code */
offs = tinf_read_bits(d, dist_bits[dist], dist_base[dist]); offs = tinf_read_bits(d, dist_bits[dist], dist_base[dist]);
if (d->dict_ring) { if (d->dict_ring) {