git: 9bd5d46c0298 - releng/12.3 - Assure that the number of bits for deflatePrime() is valid.

The branch releng/12.3 has been updated by emaste:

URL: https://cgit.FreeBSD.org/src/commit/?id=9bd5d46c0298dd2efcf0e74fa102c079e683b9a7

commit 9bd5d46c0298dd2efcf0e74fa102c079e683b9a7
Author:     Ed Maste <emaste@FreeBSD.org>
AuthorDate: 2022-04-05 23:34:52 +0000
Commit:     Ed Maste <emaste@FreeBSD.org>
CommitDate: 2022-04-05 23:34:52 +0000

    Assure that the number of bits for deflatePrime() is valid.
    
    Cherry picked from zlib 4346a16853e19b45787ce933666026903fb8f3f8
    
    Approved by:    so
    Security:       FreeBSD-SA-22:08.zlib
---
 sys/contrib/zlib/deflate.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sys/contrib/zlib/deflate.c b/sys/contrib/zlib/deflate.c
index 50e8eb84c429..587ee5e28abc 100644
--- a/sys/contrib/zlib/deflate.c
+++ b/sys/contrib/zlib/deflate.c
@@ -589,7 +589,8 @@ int ZEXPORT deflatePrime (strm, bits, value)
 
     if (deflateStateCheck(strm)) return Z_STREAM_ERROR;
     s = strm->state;
-    if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
+    if (bits < 0 || bits > 16 ||
+        s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
         return Z_BUF_ERROR;
     do {
         put = Buf_size - s->bi_valid;