X-Git-Url: https://git.cworth.org/git?a=blobdiff_plain;f=unpack.c;fp=unpack.c;h=b1f3ef3836ce72eae0a2ada17a3302990080d8e9;hb=c9eb602f6f5c10a521e7274640033f6a35deca1d;hp=00dae749f62a6a12a929bc7c05f8cfa3dced3ef6;hpb=0161769885b1bdcc3d5f6699ade8f2b88c56e570;p=gzip

diff --git a/unpack.c b/unpack.c
index 00dae74..b1f3ef3 100644
--- a/unpack.c
+++ b/unpack.c
@@ -97,6 +97,7 @@ local void read_tree()
     int len;  /* bit length */
     int base; /* base offset for a sequence of leaves */
     int n;
+    int max_leaves;
 
     /* Read the original input size, MSB first */
     orig_len = 0;
@@ -109,11 +110,15 @@ local void read_tree()
 
     /* Get the number of leaves at each bit length */
     n = 0;
+    max_leaves = 1;
     for (len = 1; len <= max_len; len++) {
 	leaves[len] = (int)get_byte();
+	if (leaves[len] > max_leaves - (len == max_len))
+	    error("too many leaves in Huffman tree");
+	max_leaves = (max_leaves - leaves[len] + 1) * 2 - 1;
 	n += leaves[len];
     }
-    if (n > LITERALS) {
+    if (n >= LITERALS) {
 	error("too many leaves in Huffman tree");
     }
     Trace((stderr, "orig_len %lu, max_len %d, leaves %d\n",