Cherry pick underflow fix.
BUG=583607
Review URL: https://codereview.chromium.org/1662313002
Cr-Commit-Position: refs/heads/master@{#373736}
diff --git a/third_party/brotli/README.chromium b/third_party/brotli/README.chromium
index 813e758..ae764cf 100644
--- a/third_party/brotli/README.chromium
+++ b/third_party/brotli/README.chromium
@@ -16,3 +16,4 @@
- .gitignore: Added.
- BUILD.gn: Added.
- brotli.gyp: Added.
+- Cherry-picked 37a320dd81db8d546cd24a45b4c61d87b45dcade (04 Feb 2016)
\ No newline at end of file
diff --git a/third_party/brotli/dec/decode.c b/third_party/brotli/dec/decode.c
index 5d4af1d9..6326c20 100644
--- a/third_party/brotli/dec/decode.c
+++ b/third_party/brotli/dec/decode.c
@@ -1700,6 +1700,10 @@
uint8_t* copy_src = &s->ringbuffer[
(pos - s->distance_code) & s->ringbuffer_mask];
uint8_t* copy_dst = &s->ringbuffer[pos];
+ /* Check for possible underflow and clamp the pointer to 0. */
+ if (PREDICT_FALSE(s->ringbuffer_end < (const uint8_t*)0 + i)) {
+ ringbuffer_end_minus_copy_length = 0;
+ }
/* update the recent distances cache */
s->dist_rb[s->dist_rb_idx & 3] = s->distance_code;
++s->dist_rb_idx;