zlib: avoid signed shift in inflatePrime - #1091

Problem:
The value of an arithmetic expression 'value << state->bits' is a subject to overflow because its operands are not cast to a larger data type before performing arithmetic
Solution: Cast value to unsigned long before the left shift to prevent signed integer overflow during shift evaluation.
Signed-off-by: a.burlakov@fobos-nt.ru

Signed-off-by: a.burlakov@fobos-nt.ru
Co-authored-by: a.burlakov <a.burlakov@aburlakov.ru>
This commit is contained in:
Aleksandr Burlakovanda.burlakov authored and GitHub committed 2026-09-16 21:19:58 +10:00
1 parent 4a65e70dfd
commit ad79af2f0c
1 file changed
+1 -1
+1 -1
View File
@@ -229,7 +229,7 @@ int ZEXPORT inflatePrime(z_streamp strm, int bits, int value)
}
if (bits > 16 || state->bits + bits > 32) return Z_STREAM_ERROR;
value &= (1L << bits) - 1;
state->hold += value << state->bits;
state->hold += (unsigned long)value << state->bits;
state->bits += bits;
return Z_OK;
}