From 384a12dea47068e712a52a4d516e8f013644a965 Mon Sep 17 00:00:00 2001 From: 000TY <125812952+000TY@users.noreply.github.com> Date: Sat, 7 Feb 2026 00:07:50 +0900 Subject: [PATCH] Fix CVE-2018-12913 regression: guard against code_len==0 infinite loop in tinfl_decompress --- miniz_tinfl.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/miniz_tinfl.c b/miniz_tinfl.c index 3de465f..a8d2a59 100644 --- a/miniz_tinfl.c +++ b/miniz_tinfl.c @@ -467,6 +467,10 @@ extern "C" counter = sym2; bit_buf >>= code_len; num_bits -= code_len; + if (code_len == 0) + { + TINFL_CR_RETURN_FOREVER(40, TINFL_STATUS_FAILED); + } if (counter & 256) break; @@ -490,6 +494,10 @@ extern "C" } bit_buf >>= code_len; num_bits -= code_len; + if (code_len == 0) + { + TINFL_CR_RETURN_FOREVER(54, TINFL_STATUS_FAILED); + } pOut_buf_cur[0] = (mz_uint8)counter; if (sym2 & 256)