1 files changed, 39 insertions, 23 deletions

diff --git a/uncompr.c b/uncompr.c
index 5e256663b451..2195e7855064 100644
--- a/uncompr.c
+++ b/uncompr.c
@@ -1,5 +1,5 @@
 /* uncompr.c -- decompress a memory buffer
- * Copyright (C) 1995-2003, 2010, 2014, 2016 Jean-loup Gailly, Mark Adler
+ * Copyright (C) 1995-2026 Jean-loup Gailly, Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -23,24 +23,24 @@
    memory, Z_BUF_ERROR if there was not enough room in the output buffer, or
    Z_DATA_ERROR if the input data was corrupted, including if the input data is
    an incomplete zlib stream.
+
+     The _z versions of the functions take size_t length arguments.
 */
-int ZEXPORT uncompress2(Bytef *dest, uLongf *destLen, const Bytef *source,
-                        uLong *sourceLen) {
+int ZEXPORT uncompress2_z(Bytef *dest, z_size_t *destLen, const Bytef *source,
+                          z_size_t *sourceLen) {
     z_stream stream;
     int err;
     const uInt max = (uInt)-1;
-    uLong len, left;
-    Byte buf[1];    /* for detection of incomplete stream when *destLen == 0 */
+    z_size_t len, left;
+
+    if (sourceLen == NULL || (*sourceLen > 0 && source == NULL) ||
+        destLen == NULL || (*destLen > 0 && dest == NULL))
+        return Z_STREAM_ERROR;
 
     len = *sourceLen;
-    if (*destLen) {
-        left = *destLen;
-        *destLen = 0;
-    }
-    else {
-        left = 1;
-        dest = buf;
-    }
+    left = *destLen;
+    if (left == 0 && dest == Z_NULL)
+        dest = (Bytef *)&stream.reserved;       /* next_out cannot be NULL */
 
     stream.next_in = (z_const Bytef *)source;
     stream.avail_in = 0;
@@ -56,30 +56,46 @@ int ZEXPORT uncompress2(Bytef *dest, uLongf *destLen, const Bytef *source,
 
     do {
         if (stream.avail_out == 0) {
-            stream.avail_out = left > (uLong)max ? max : (uInt)left;
+            stream.avail_out = left > (z_size_t)max ? max : (uInt)left;
             left -= stream.avail_out;
         }
         if (stream.avail_in == 0) {
-            stream.avail_in = len > (uLong)max ? max : (uInt)len;
+            stream.avail_in = len > (z_size_t)max ? max : (uInt)len;
             len -= stream.avail_in;
         }
         err = inflate(&stream, Z_NO_FLUSH);
     } while (err == Z_OK);
 
-    *sourceLen -= len + stream.avail_in;
-    if (dest != buf)
-        *destLen = stream.total_out;
-    else if (stream.total_out && err == Z_BUF_ERROR)
-        left = 1;
+    /* Set len and left to the unused input data and unused output space. Set
+       *sourceLen to the amount of input consumed. Set *destLen to the amount
+       of data produced. */
+    len += stream.avail_in;
+    left += stream.avail_out;
+    *sourceLen -= len;
+    *destLen -= left;
 
     inflateEnd(&stream);
     return err == Z_STREAM_END ? Z_OK :
            err == Z_NEED_DICT ? Z_DATA_ERROR  :
-           err == Z_BUF_ERROR && left + stream.avail_out ? Z_DATA_ERROR :
+           err == Z_BUF_ERROR && len == 0 ? Z_DATA_ERROR :
            err;
 }
-
+int ZEXPORT uncompress2(Bytef *dest, uLongf *destLen, const Bytef *source,
+                        uLong *sourceLen) {
+    int ret;
+    z_size_t got = *destLen, used = *sourceLen;
+    ret = uncompress2_z(dest, &got, source, &used);
+    *sourceLen = (uLong)used;
+    *destLen = (uLong)got;
+    return ret;
+}
+int ZEXPORT uncompress_z(Bytef *dest, z_size_t *destLen, const Bytef *source,
+                         z_size_t sourceLen) {
+    z_size_t used = sourceLen;
+    return uncompress2_z(dest, destLen, source, &used);
+}
 int ZEXPORT uncompress(Bytef *dest, uLongf *destLen, const Bytef *source,
                        uLong sourceLen) {
-    return uncompress2(dest, destLen, source, &sourceLen);
+    uLong used = sourceLen;
+    return uncompress2(dest, destLen, source, &used);
 }