Potential problem
In inflatePrime (zlib/inflate.c, 219), the expression value << state->bits (zlib/inflate.c, 232) is evaluated using the type of value, which is int. If the shifted result cannot be represented by int, signed integer overflow occurs and the behavior is undefined before the result is added to state->hold.
For example, with state->bits = 16, bits = 16, and value = 0xFFFF, the expression value << state->bits produces a value that cannot be represented by a 32-bit signed int.
Possible solution
It is suggested to cast value to unsigned long before performing the left shift:
state->hold += (unsigned long)value << state->bits;
This ensures that the shift is performed using an unsigned type large enough for the resulting value and prevents signed integer overflow.
Found by Linux Verification Center (portal.linuxtesting.ru) with SVACE.
Author A. Burlakov.
Potential problem
In
inflatePrime(zlib/inflate.c, 219), the expressionvalue << state->bits(zlib/inflate.c, 232) is evaluated using the type ofvalue, which isint. If the shifted result cannot be represented byint, signed integer overflow occurs and the behavior is undefined before the result is added tostate->hold.For example, with
state->bits = 16,bits = 16, andvalue = 0xFFFF, the expressionvalue << state->bitsproduces a value that cannot be represented by a 32-bit signedint.Possible solution
It is suggested to cast
valuetounsigned longbefore performing the left shift:state->hold += (unsigned long)value << state->bits;This ensures that the shift is performed using an unsigned type large enough for the resulting value and prevents signed integer overflow.
Found by Linux Verification Center (portal.linuxtesting.ru) with SVACE.
Author A. Burlakov.