Avoid huffman tree buffer overrun in huffman_import_tree_rle

Issue #90
rtissera · Feb 19, 2023 · de74053 · de74053
1 parent a20e04c
commit de74053
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/libchdr_huffman.c b/src/libchdr_huffman.c
@@ -212,6 +212,8 @@ enum huffman_error huffman_import_tree_rle(struct huffman_decoder* decoder, stru
 			else
 			{
 				int repcount = bitstream_read(bitbuf, numbits) + 3;
+				if (repcount + curnode > decoder->numcodes)
+					return HUFFERR_INVALID_DATA;
 				while (repcount--)
 					decoder->huffnode[curnode++].numbits = nodebits;
 			}