changeset 29843:c4f9513b09f1 stable

ls-mat5.cc: Avoid integer overflow in calculation of buffer size for zlib (bug #55427). * ls-mat5.cc (save_mat5_binary_element): Use zlib function "compressBound" to query upper limit for output buffer when compressing.
author Markus Mützel <markus.muetzel@gmx.de>
date Thu, 01 Jul 2021 13:24:03 +0200
parents c0e14e924dab
children ceb2259f7c11 78cb255c78a4
files libinterp/corefcn/ls-mat5.cc
diffstat 1 files changed, 1 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/libinterp/corefcn/ls-mat5.cc	Tue Jun 29 19:19:31 2021 +0200
+++ b/libinterp/corefcn/ls-mat5.cc	Thu Jul 01 13:24:03 2021 +0200
@@ -2325,7 +2325,7 @@
           // + 12 bytes.  Reality is it must be larger again than that.
           std::string buf_str = buf.str ();
           uLongf srcLen = buf_str.length ();
-          uLongf destLen = srcLen * 101 / 100 + 12;
+          uLongf destLen = compressBound (srcLen);
           OCTAVE_LOCAL_BUFFER (char, out_buf, destLen);
 
           if (compress (reinterpret_cast<Bytef *> (out_buf), &destLen,