Commit 12815e2223085c1b990cfef754335f7b0d3bb2d0 | zig

author	Ryan Liptak <squeek502@hotmail.com> 2026-06-16 16:23:00-07:00
committer	Ryan Liptak <squeek502@hotmail.com> 2026-06-17 09:15:17+02:00
log	12815e2223085c1b990cfef754335f7b0d3bb2d0
tree	fff484ae30b214eaf77d538a19a6be21b8a60d78
parent	369db8bd74b56814fa67e49b44c66bfeeaedbc4f

flate: Correct math when calculating number of available bits

Before this fix, integer overflow would be hit later on, after this function would fail to report that `n` bits were not available.

Fixes https://codeberg.org/ziglang/zig/issues/35789

1 files changed, 10 insertions(+), 1 deletions(-)

lib
- std
  - compress
    flate
    Decompress.zig

lib/std/compress/flate/Decompress.zig+10-1

 @@ -578,7 +578,7 @@ fn peekBitsShortEnding(d: *Decompress, n: u4) !u16 {
 }
 fn tossBitsShort(d: *Decompress, n: u4) !void {
-    if (d.input.bufferedLen() * 8 + d.consumed_bits < n) return error.EndOfStream;
+    if (d.input.bufferedLen() * 8 - d.consumed_bits < n) return error.EndOfStream;
     d.tossBits(n);
 }
 @@ -1064,6 +1064,15 @@ test "bug 18966" {
     );
 }
+test "truncated input ending when reading dynamic length bits" {
+    try testFailure(.raw, &[_]u8{
+        0x15, 0xd5, 0x07, 0x3b, 0x16, 0x0c, 0x03, 0x86,
+        0x61, 0x2b, 0xa3, 0xec, 0xec, 0x15, 0x95, 0x6c,
+        0x92, 0x4d, 0x19, 0x95, 0x4a, 0xb6, 0x22, 0x23,
+        0xc9,
+    }, error.EndOfStream);
+}
 test "reading into empty buffer" {
     // Inspired by https://github.com/ziglang/zig/issues/19895
     const input = &[_]u8{