MFC 1.12: correct bug introduced in 1.11 where ZFREE was moved to a

  point after the structural members were clobbered by stores into a
  union'd structure.
MFC 1.13: correct deflate window size check.

1 files changed, 6 insertions, 2 deletions

diff --git a/sys/net/zlib.c b/sys/net/zlib.c
index bf1f72dae344..03bf230dd098 100644
--- a/sys/net/zlib.c
+++ b/sys/net/zlib.c
@@ -776,7 +776,7 @@ int deflateInit2_(strm, level, method, windowBits, memLevel, strategy,
         windowBits = -windowBits;
     }
     if (memLevel < 1 || memLevel > MAX_MEM_LEVEL || method != Z_DEFLATED ||
-        windowBits < 8 || windowBits > 15 || level < 0 || level > 9 ||
+        windowBits < 9 || windowBits > 15 || level < 0 || level > 9 ||
 	strategy < 0 || strategy > Z_HUFFMAN_ONLY) {
         return Z_STREAM_ERROR;
     }
@@ -3951,11 +3951,15 @@ int r;
           r = Z_MEM_ERROR;
           LEAVE
         }
+	/*
+	 * this ZFREE must occur *BEFORE* we mess with sub.decode, because
+	 * sub.trees is union'd with sub.decode.
+	 */
+        ZFREE(z, s->sub.trees.blens);
         s->sub.decode.codes = c;
         s->sub.decode.tl = tl;
         s->sub.decode.td = td;
       }
-      ZFREE(z, s->sub.trees.blens);
       s->mode = CODES;
     case CODES:
       UPDATE