--- gzip-1.3.5.orig/unlzh.c

+++ gzip-1.3.5/unlzh.c

@@ -149,7 +149,12 @@ local void make_table(nchar, bitlen, tab

     unsigned i, k, len, ch, jutbits, avail, nextcode, mask;

     for (i = 1; i <= 16; i++) count[i] = 0;

-    for (i = 0; i < (unsigned)nchar; i++) count[bitlen[i]]++;

+    for (i = 0; i < (unsigned)nchar; i++) {

+	if (bitlen[i] > 16)

+	    error("Bad table");

+	else

+	    count[bitlen[i]]++;

+    }

     start[1] = 0;

     for (i = 1; i <= 16; i++)

@@ -170,7 +175,7 @@ local void make_table(nchar, bitlen, tab

     i = start[tablebits + 1] >> jutbits;

     if (i != 0) {

 	k = 1 << tablebits;

-	while (i != k) table[i++] = 0;

+	while (i < k) table[i++] = 0;

     }

     avail = nchar;

@@ -179,6 +184,8 @@ local void make_table(nchar, bitlen, tab

 	if ((len = bitlen[ch]) == 0) continue;

 	nextcode = start[len] + weight[len];

 	if (len <= (unsigned)tablebits) {

+	    if (nextcode > 1 << tablebits)

+		error("Bad table");

 	    for (i = start[len]; i < nextcode; i++) table[i] = ch;

 	} else {

 	    k = start[len];

@@ -228,7 +235,7 @@ local void read_pt_len(nn, nbit, i_speci

 	    pt_len[i++] = c;

 	    if (i == i_special) {

 		c = getbits(2);

-		while (--c >= 0) pt_len[i++] = 0;

+		while (--c >= 0 && i < nn) pt_len[i++] = 0;

 	    }

 	}

 	while (i < nn) pt_len[i++] = 0;

@@ -256,14 +263,14 @@ local void read_c_len()

 		    if (bitbuf & mask) c = right[c];

 		    else               c = left [c];

 		    mask >>= 1;

-		} while (c >= NT);

+		} while (c >= NT && (mask || c != left[c]));

 	    }

 	    fillbuf((int) pt_len[c]);

 	    if (c <= 2) {

 		if      (c == 0) c = 1;

 		else if (c == 1) c = getbits(4) + 3;

 		else             c = getbits(CBIT) + 20;

-		while (--c >= 0) c_len[i++] = 0;

+		while (--c >= 0 && i < NC) c_len[i++] = 0;

 	    } else c_len[i++] = c - 2;

 	}

 	while (i < NC) c_len[i++] = 0;

@@ -292,7 +299,7 @@ local unsigned decode_c()

 	    if (bitbuf & mask) j = right[j];

 	    else               j = left [j];

 	    mask >>= 1;

-	} while (j >= NC);

+	} while (j >= NC && (mask || j != left[j]));

     }

     fillbuf((int) c_len[j]);

     return j;

@@ -309,7 +316,7 @@ local unsigned decode_p()

 	    if (bitbuf & mask) j = right[j];

 	    else               j = left [j];

 	    mask >>= 1;

-	} while (j >= NP);

+	} while (j >= NP && (mask || j != left[j]));

     }

     fillbuf((int) pt_len[j]);

     if (j != 0) j = ((unsigned) 1 << (j - 1)) + getbits((int) (j - 1));

@@ -356,7 +363,7 @@ local unsigned decode(count, buffer)

     while (--j >= 0) {

 	buffer[r] = buffer[i];

 	i = (i + 1) & (DICSIZ - 1);

-	if (++r == count) return r;

+	if (++r >= count) return r;

     }

     for ( ; ; ) {

 	c = decode_c();

@@ -366,14 +373,14 @@ local unsigned decode(count, buffer)

 	}

 	if (c <= UCHAR_MAX) {

 	    buffer[r] = c;

-	    if (++r == count) return r;

+	    if (++r >= count) return r;

 	} else {

 	    j = c - (UCHAR_MAX + 1 - THRESHOLD);

 	    i = (r - decode_p() - 1) & (DICSIZ - 1);

 	    while (--j >= 0) {

 		buffer[r] = buffer[i];

 		i = (i + 1) & (DICSIZ - 1);

-		if (++r == count) return r;

+		if (++r >= count) return r;

 	    }

 	}

     }

--- gzip-1.3.5.orig/unpack.c

+++ gzip-1.3.5/unpack.c

@@ -113,7 +113,7 @@ local void read_tree()

 	leaves[len] = (int)get_byte();

 	n += leaves[len];

     }

-    if (n > LITERALS) {

+    if (n >= LITERALS) {

 	error("too many leaves in Huffman tree");

     }

     Trace((stderr, "orig_len %lu, max_len %d, leaves %d\n",

@@ -169,7 +169,7 @@ local void build_tree()

     prefixp = &prefix_len[1<<peek_bits];

     for (len = 1; len <= peek_bits; len++) {

 	int prefixes = leaves[len] << (peek_bits-len); /* may be 0 */

-	while (prefixes--) *--prefixp = (uch)len;

+	while (prefixes-- && prefixp > prefix_len) *--prefixp = (uch)len;

     }

     /* The length of all other codes is unknown: */

     while (prefixp > prefix_len) *--prefixp = 0;