X-Git-Url: https://git.proxmox.com/?p=mirror_edk2.git;a=blobdiff_plain;f=MdeModulePkg%2FLibrary%2FBrotliCustomDecompressLib%2Fdec%2Fdecode.c;h=3bee3e71fe0340c6680b30597d86a89c98ed04d1;hp=7ba1d0512e251f806d56aff5b7c6c2791b8bf465;hb=792ace0ac391c37c1299322340abdf74e2603795;hpb=841b259062d5f71be41c7358217d3945038a37bf

diff --git a/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c b/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
index 7ba1d0512e..3bee3e71fe 100644
--- a/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
+++ b/MdeModulePkg/Library/BrotliCustomDecompressLib/dec/decode.c
@@ -56,7 +56,7 @@ BrotliDecoderState* BrotliDecoderCreateInstance(
     brotli_alloc_func alloc_func, brotli_free_func free_func, void* opaque) {
   BrotliDecoderState* state = 0;
   if (!alloc_func && !free_func) {
-    state = (BrotliDecoderState*)malloc(sizeof(BrotliDecoderState));
+    state = (BrotliDecoderState*)BrDummyMalloc(sizeof(BrotliDecoderState));
   } else if (alloc_func && free_func) {
     state = (BrotliDecoderState*)alloc_func(opaque, sizeof(BrotliDecoderState));
   }
@@ -802,6 +802,7 @@ static BROTLI_INLINE uint32_t ReadBlockLength(const HuffmanCode* table,
   uint32_t code;
   uint32_t nbits;
   code = ReadSymbol(table, br);
+  if (code >= BROTLI_NUM_BLOCK_LEN_SYMBOLS) code = BROTLI_NUM_BLOCK_LEN_SYMBOLS - 1;
   nbits = kBlockLengthPrefixCode[code].nbits; /* nbits == 2..24 */
   return kBlockLengthPrefixCode[code].offset + BrotliReadBits(br, nbits);
 }
@@ -854,6 +855,7 @@ static BROTLI_NOINLINE void InverseMoveToFrontTransform(
   uint32_t i = 4;
   uint32_t upper_bound = state->mtf_upper_bound;
   uint8_t* mtf = &state->mtf[4];  /* Make mtf[-1] addressable. */
+  uint8_t* mtft = &state->mtf[3];
   /* Load endian-aware constant. */
   const uint8_t b0123[4] = {0, 1, 2, 3};
   uint32_t pattern;
@@ -872,13 +874,13 @@ static BROTLI_NOINLINE void InverseMoveToFrontTransform(
   for (i = 0; i < v_len; ++i) {
     int index = v[i];
     uint8_t value = mtf[index];
-    upper_bound |= v[i];
+    upper_bound |= (uint32_t)v[i];
     v[i] = value;
-    mtf[-1] = value;
-    do {
+    mtft[0] = value;
+    while (index >= 0) {
+      mtft[index + 1] = mtft[index];
       index--;
-      mtf[index + 1] = mtf[index];
-    } while (index >= 0);
+    }
   }
   /* Remember amount of elements to be reinitialized. */
   state->mtf_upper_bound = upper_bound;
@@ -1498,6 +1500,7 @@ static BROTLI_INLINE BROTLI_BOOL ReadCommandInternal(
       return BROTLI_FALSE;
     }
   }
+  if (cmd_code >= BROTLI_NUM_COMMAND_SYMBOLS) cmd_code = BROTLI_NUM_COMMAND_SYMBOLS - 1;
   v = kCmdLut[cmd_code];
   s->distance_code = v.distance_code;
   s->distance_context = v.context;
@@ -2209,7 +2212,9 @@ BrotliDecoderResult BrotliDecoderDecompressStream(
         }
         s->max_distance = s->max_backward_distance;
         if (s->state == BROTLI_STATE_COMMAND_POST_WRITE_1) {
-          memcpy(s->ringbuffer, s->ringbuffer_end, (size_t)s->pos);
+          if (s->ringbuffer != 0) {
+            memcpy(s->ringbuffer, s->ringbuffer_end, (size_t)s->pos);
+          }
           if (s->meta_block_remaining_len == 0) {
             /* Next metablock, if any */
             s->state = BROTLI_STATE_METABLOCK_DONE;