This is text comes from Mark Adler The problem was that my previous check for an incomplete code set was much too liberal. It allowed the passage of pathological code descriptions, such as a single code of length 10, like what's in zlib-testcase.gz (twice). The deflate spec allows for distance codes with a single code, but in that case that single code must have length 1. The patch below now permits incomplete codes only if they consist of a single code of length 1. Though the spec only mentions distance codes in this regard, my patch also allows literal/length codes with a single code, which would permit a dynamic block that only defines the end-of-block code. This should be permitted by the spec, and it won't crash the code, so I'm letting it through. The consequence of letting pathological code descriptions through was that filling out the decoding table with invalid code markers overran the ENOUGH sized array and overwrote some other stuff in memory (whatever happened to follow the inflate state). I thought that I had prevented that with a check on how much of ENOUGH was being used by the literal/length code, and knowing the maximum that could possibly be used by a distance code based on an exhaustive search (MAXD). However my exhaustive search only included valid distance code sets, and so zlib-testcase.gz overran MAXD, after a similar pathological literal/length code set had used most of ENOUGH - MAXD. The patch now only allows valid code sets through, which are either exactly complete code sets or code sets that consist of a single code of length 1.
Created attachment 116314 [details] Proposed patch from upstream for this issue.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2005-569.html
Lifting embargo