inflate_fast: sout is already a short so ptr arith was off by one.

inflate_fast() can do either POST INC or PRE INC on its pointers walking
the memory to decompress.  Default is PRE INC.

The sout pointer offset was miscalculated in one case as the calculation
assumed sout was a char * This breaks inflate_fast() iff configured to do
POST INC.

Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/lib/zlib_inflate/inffast.c b/lib/zlib_inflate/inffast.c
index fa62fc7a94f9561197f2e549a269c3a1d8c292b6..2c13ecc5bb2c7ea7563e7096a61b93d13275d675 100644 (file)
--- a/lib/zlib_inflate/inffast.c
+++ b/lib/zlib_inflate/inffast.c
@@ -286,7 +286,7 @@ void inflate_fast(z_streamp strm, unsigned start)
                    } else { /* dist == 1 or dist == 2 */
                        unsigned short pat16;
 
-                       pat16 = *(sout-2+2*OFF);
+                       pat16 = *(sout-1+OFF);
                        if (dist == 1) {
                                union uu mm;
                                /* copy one char pattern to both bytes */