Assure that the number of bits for deflatePrime() is valid.

diff --git a/deflate.c b/deflate.c
index 19cba873ae98c9836b3030f4047d97e750d01da3..23aef187882ebacb6b9eaaba0c308b955eff9927 100644 (file)
--- a/deflate.c
+++ b/deflate.c
@@ -589,7 +589,8 @@ int ZEXPORT deflatePrime (strm, bits, value)
 
     if (deflateStateCheck(strm)) return Z_STREAM_ERROR;
     s = strm->state;
-    if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
+    if (bits < 0 || bits > 16 ||
+        s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3))
         return Z_BUF_ERROR;
     do {
         put = Buf_size - s->bi_valid;