[freetype2] master b260dc9: [bzip2, gzip] Avoid access of unitialized memory (#46109).

[Werner LEMBERG]

branch: master
commit b260dc9fab7c8eac410f49ef5f1d173db69b7ac8
Author: Werner Lemberg <address@hidden>
Commit: Werner Lemberg <address@hidden>

    [bzip2, gzip] Avoid access of unitialized memory (#46109).
    
    * src/bzip2/ftbzip2.c (ft_bzip2_file_fill_input), src/gzip/ftgzip.c
    (ft_gzip_file_fill_input): In case of an error, adjust the limit to
    avoid copying uninitialized memory.
---
 ChangeLog           |    8 ++++++++
 src/bzip2/ftbzip2.c |    6 ++++++
 src/gzip/ftgzip.c   |    6 ++++++
 3 files changed, 20 insertions(+), 0 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index b0946c7..d7014cd 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,14 @@
 
        [bzip2, gzip] Avoid access of unitialized memory (#46109).
 
+       * src/bzip2/ftbzip2.c (ft_bzip2_file_fill_input), src/gzip/ftgzip.c
+       (ft_gzip_file_fill_input): In case of an error, adjust the limit to
+       avoid copying uninitialized memory.
+
+2015-10-03  Werner Lemberg  <address@hidden>
+
+       [bzip2, gzip] Avoid access of unitialized memory (#46109).
+
        * src/bzip2/ftbzip2.c (ft_bzip2_file_fill_output), src/gzip/ftgzip.c
        (ft_gzip_file_fill_output): In case of an error, adjust the limit to
        avoid copying uninitialized memory.
diff --git a/src/bzip2/ftbzip2.c b/src/bzip2/ftbzip2.c
index d4a85f2..cf94733 100644
--- a/src/bzip2/ftbzip2.c
+++ b/src/bzip2/ftbzip2.c
@@ -254,7 +254,10 @@
       size = stream->read( stream, stream->pos, zip->input,
                            FT_BZIP2_BUFFER_SIZE );
       if ( size == 0 )
+      {
+        zip->limit = zip->cursor;
         return FT_THROW( Invalid_Stream_Operation );
+      }
     }
     else
     {
@@ -263,7 +266,10 @@
         size = FT_BZIP2_BUFFER_SIZE;
 
       if ( size == 0 )
+      {
+        zip->limit = zip->cursor;
         return FT_THROW( Invalid_Stream_Operation );
+      }
 
       FT_MEM_COPY( zip->input, stream->base + stream->pos, size );
     }
diff --git a/src/gzip/ftgzip.c b/src/gzip/ftgzip.c
index 36134a8..422035c 100644
--- a/src/gzip/ftgzip.c
+++ b/src/gzip/ftgzip.c
@@ -377,7 +377,10 @@
       size = stream->read( stream, stream->pos, zip->input,
                            FT_GZIP_BUFFER_SIZE );
       if ( size == 0 )
+      {
+        zip->limit = zip->cursor;
         return FT_THROW( Invalid_Stream_Operation );
+      }
     }
     else
     {
@@ -386,7 +389,10 @@
         size = FT_GZIP_BUFFER_SIZE;
 
       if ( size == 0 )
+      {
+        zip->limit = zip->cursor;
         return FT_THROW( Invalid_Stream_Operation );
+      }
 
       FT_MEM_COPY( zip->input, stream->base + stream->pos, size );
     }