* ext/zlib/zlib.c (gzfile_read_header): Ensure that each section of

  gzip header is readable to avoid SEGV.

* test/zlib/test_zlib.rb (test_corrupted_header): Test it.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@33023 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 14 insertions, 0 deletions

diff --git a/test/zlib/test_zlib.rb b/test/zlib/test_zlib.rb
index d118f7e503..37781bc8e7 100644
--- a/test/zlib/test_zlib.rb
+++ b/test/zlib/test_zlib.rb
@@ -694,6 +694,20 @@ if defined? Zlib
       assert_equal("foo", Zlib::GzipReader.wrap(f) {|gz| gz.read })
       assert_raise(IOError) { f.close }
     end
+
+    def test_corrupted_header
+      gz = Zlib::GzipWriter.new(StringIO.new(s = ""))
+      gz.orig_name = "X"
+      gz.comment = "Y"
+      gz.print("foo")
+      gz.finish
+      # 14: magic(2) + method(1) + flag(1) + mtime(4) + exflag(1) + os(1) + orig_name(2) + comment(2)
+      1.upto(14) do |idx|
+        assert_raise(Zlib::GzipFile::Error, idx) do
+          Zlib::GzipReader.new(StringIO.new(s[0, idx])).read
+        end
+      end
+    end
   end
 
   class TestZlibGzipWriter < Test::Unit::TestCase