From fa03b567552ecc1a2a91850c959220ab28f178dd Mon Sep 17 00:00:00 2001
From: yangyudong <yangyudong3@huawei.com>
Date: Fri, 21 Oct 2022 12:02:55 +0800
Subject: cve-2022-37434: Fix a bug when getting a gzip header extra
 field with inflate().

Bug url: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-37434
---
 jdk/src/share/native/java/util/zip/zlib/inflate.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/jdk/src/share/native/java/util/zip/zlib/inflate.c b/jdk/src/share/native/java/util/zip/zlib/inflate.c
index ca904e744..63decdb19 100644
--- a/jdk/src/share/native/java/util/zip/zlib/inflate.c
+++ b/jdk/src/share/native/java/util/zip/zlib/inflate.c
@@ -783,8 +783,9 @@ int flush;
                 if (copy > have) copy = have;
                 if (copy) {
                     if (state->head != Z_NULL &&
-                        state->head->extra != Z_NULL) {
-                        len = state->head->extra_len - state->length;
+                        state->head->extra != Z_NULL &&
+                        (len = state->head->extra_len - state->length) <
+                            state->head->extra_max) {
                         zmemcpy(state->head->extra + len, next,
                                 len + copy > state->head->extra_max ?
                                 state->head->extra_max - len : copy);
-- 
2.22.0