From 2d1a7d7b34c4eedca3d91a6896b92078e6fd2220 Mon Sep 17 00:00:00 2001 From: Girma Metaferia Date: Mon, 31 Aug 2026 05:01:27 -0400 Subject: [PATCH] Reject a null dictionary in inflateSetDictionary(). --- inflate.c | 3 ++- test/infcover.c | 3 +++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/inflate.c b/inflate.c index 5f5d4922b7..fd918bdcf1 100644 --- a/inflate.c +++ b/inflate.c @@ -1191,7 +1191,8 @@ int ZEXPORT inflateSetDictionary(z_streamp strm, const Bytef *dictionary, int ret; /* check state */ - if (inflateStateCheck(strm)) return Z_STREAM_ERROR; + if (inflateStateCheck(strm) || dictionary == Z_NULL) + return Z_STREAM_ERROR; state = (struct inflate_state FAR *)strm->state; if (state->wrap != 0 && state->mode != DICT) return Z_STREAM_ERROR; diff --git a/test/infcover.c b/test/infcover.c index f1ad0f9122..d21257fcb4 100644 --- a/test/infcover.c +++ b/test/infcover.c @@ -361,6 +361,9 @@ local void cover_support(void) ret = inflatePrime(&strm, -1, 0); assert(ret == Z_OK); ret = inflateSetDictionary(&strm, Z_NULL, 0); assert(ret == Z_STREAM_ERROR); + ret = inflateReset2(&strm, -15); assert(ret == Z_OK); + ret = inflateSetDictionary(&strm, Z_NULL, 1); + assert(ret == Z_STREAM_ERROR); ret = inflateEnd(&strm); assert(ret == Z_OK); mem_done(&strm, "prime");