From 8857d08d80d3c6cbf3163915e80137451a453c53 Mon Sep 17 00:00:00 2001 From: Simon Legner Date: Wed, 22 Jul 2026 22:16:52 +0200 Subject: [PATCH] Fix BSS buffer overflow in osmpbf-outline zlib decompression Fixes #94. --- tools/osmpbf-outline.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tools/osmpbf-outline.cpp b/tools/osmpbf-outline.cpp index 45a5bbc..9b9d4ce 100644 --- a/tools/osmpbf-outline.cpp +++ b/tools/osmpbf-outline.cpp @@ -232,6 +232,12 @@ int main(int argc, char *argv[]) { debug(" contains zlib-compressed data: %u bytes", sz); debug(" uncompressed size: %u bytes", blob.raw_size()); + // ensure the raw_size fits into the unpack_buffer, otherwise + // zlib would inflate past the end of the fixed-size buffer + if (blob.raw_size() < 0 || blob.raw_size() > OSMPBF::max_uncompressed_blob_size) { + err(" raw_size is bigger then allowed (%d > %u)", blob.raw_size(), OSMPBF::max_uncompressed_blob_size); + } + // zlib information z_stream z;