From 0b2443176885debf7896df5bf694b0ec3e75e789 Mon Sep 17 00:00:00 2001
From: tabudz <64760144+tabudz@users.noreply.github.com>
Date: Mon, 10 Mar 2025 04:27:37 +0700
Subject: fix(deps/zlib): CVE-2022-37434: Potential Vulnerability in Cloned
 Function (#21599)

https://nvd.nist.gov/vuln/detail/CVE-2022-37434
madler/zlib@eff308a
---
 deps/zlib/inflate.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'deps')

diff --git a/deps/zlib/inflate.c b/deps/zlib/inflate.c
index 7be8c63662..7a72897492 100644
--- a/deps/zlib/inflate.c
+++ b/deps/zlib/inflate.c
@@ -763,9 +763,10 @@ int flush;
                 copy = state->length;
                 if (copy > have) copy = have;
                 if (copy) {
+                    len = state->head->extra_len - state->length;
                     if (state->head != Z_NULL &&
-                        state->head->extra != Z_NULL) {
-                        len = state->head->extra_len - state->length;
+                        state->head->extra != Z_NULL &&
+                        len < state->head->extra_max) {
                         zmemcpy(state->head->extra + len, next,
                                 len + copy > state->head->extra_max ?
                                 state->head->extra_max - len : copy);
-- 
cgit v1.2.3