>From 1a61dbfbb1e60f51c91682e6ed87bb404b02d851 Mon Sep 17 00:00:00 2001
From: Paul Eggert <address@hidden>
Date: Fri, 30 Nov 2018 13:00:42 -0800
Subject: [PATCH] gzip: fix use of uninitialized memory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Problem reported by Hanno Böck (Bug#33501).
* NEWS: Mention this.
* inflate.c (inflate_dynamic): Return if code is invalid.
Fix by Mark Adler.
* tests/hufts: Add test case for the bug.
---
 NEWS        | 3 +++
 inflate.c   | 6 ++++++
 tests/hufts | 9 ++++++++-
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/NEWS b/NEWS
index c3113ed..caa77bb 100644
--- a/NEWS
+++ b/NEWS
@@ -13,6 +13,9 @@ GNU gzip NEWS                                    -*- outline -*-
 
 ** Bug fixes
 
+  A use of uninitialized memory on some malformed inputs has been fixed.
+  [bug present since the beginning]
+
   A few theoretical race conditions in signal handers have been fixed.
   These bugs most likely do not happen on practical platforms.
   [bugs present since the beginning]
diff --git a/inflate.c b/inflate.c
index d372685..bcafcf1 100644
--- a/inflate.c
+++ b/inflate.c
@@ -799,6 +799,12 @@ inflate_dynamic(void)
     NEEDBITS((unsigned)bl)
     j = (td = tl + ((unsigned)b & m))->b;
     DUMPBITS(j)
+    if (td->e == 99)
+      {
+        /* Invalid code.  */
+        huft_free (tl);
+        return 2;
+      }
     j = td->v.n;
     if (j < 16)                 /* length of code in bits (0..15) */
       ll[i++] = l = j;          /* save last length in l */
diff --git a/tests/hufts b/tests/hufts
index 1076c83..5660ec3 100755
--- a/tests/hufts
+++ b/tests/hufts
@@ -1,5 +1,5 @@
 #!/bin/sh
-# Exercise a bug whereby an invalid input could make gzip -d misbehave.
+# Exercise bugs whereby invalid input could make gzip -d misbehave.
 
 # Copyright (C) 2009-2018 Free Software Foundation, Inc.
 
@@ -30,4 +30,11 @@ compare /dev/null out || fail=1
 sed 's/.*hufts-segv.gz: /...: /' err > k; mv k err || fail=1
 compare exp err || fail=1
 
+printf '\037\213\010\000\060\060\060\060\060\060\144\000\000\000' > bug33501 \
+  || framework_failure_
+printf '\ngzip: stdin: invalid compressed data--format violated\n' >exp33501 \
+  || framework_failure_
+returns_ 1 gzip -d <bug33501 >out33501 2> err33501 || fail=1
+compare exp33501 err33501 || fail=1
+
 Exit $fail
-- 
2.19.2