diff --git a/fuzzing/PerMessageDeflate.cpp b/fuzzing/PerMessageDeflate.cpp index 1867994..f16796e 100644 --- a/fuzzing/PerMessageDeflate.cpp +++ b/fuzzing/PerMessageDeflate.cpp @@ -24,7 +24,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { std::string_view inflation = staticData.inflationStream.inflate(&staticData.zlibContext, std::string_view((char *) data, size), 256); if (inflation.length() > 256) { /* Cause ASAN to freak out */ - //delete (int *) (void *) 1; + delete (int *) (void *) 1; } }); diff --git a/src/PerMessageDeflate.h b/src/PerMessageDeflate.h index 4a631ab..e0ed2fb 100644 --- a/src/PerMessageDeflate.h +++ b/src/PerMessageDeflate.h @@ -161,9 +161,20 @@ struct InflationStream { if (zlibContext->dynamicInflationBuffer.length()) { zlibContext->dynamicInflationBuffer.append(zlibContext->inflationBuffer, LARGE_BUFFER_SIZE - inflationStream.avail_out); + + /* Let's be strict about the max size */ + if (zlibContext->dynamicInflationBuffer.length() > maxPayloadLength) { + return {nullptr, 0}; + } + return {zlibContext->dynamicInflationBuffer.data(), zlibContext->dynamicInflationBuffer.length()}; } + /* Let's be strict about the max size */ + if ((LARGE_BUFFER_SIZE - inflationStream.avail_out) > maxPayloadLength) { + return {nullptr, 0}; + } + return {zlibContext->inflationBuffer, LARGE_BUFFER_SIZE - inflationStream.avail_out}; }