610079 - libssl: ssl3_DeflateDecompress needs to verify decompressoin finished

Status: NEW

(NSS :: Libraries, defect, P5)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

inflate() will return Z_OK if the output buffer fills up before all the decompressed data can be written to it. The current code assumes Z_OK means that all the data has been decompressed. After the check for Z_OK, a check for avail_out > 0 and/or avail_in == 0 needs to be made. I think the caller also needs to ensure that there is extra space in the output buffer so that avail_out==0 isn't ambiguous. Alternately, when avail_out==0 then we can call inflate() again with a temporary (stack) buffer as the output buffer, and fail if inflate() actually writes anything to that buffer.