lzma: fix overflow in Ppmd7Enc.c

illwieckz · illwieckz · commit d7b11eea17aa · 2025-03-05T14:27:08.000+01:00
crnlib/lzma/Ppmd7Enc.c:
  R-&gt;Low += start * R-&gt;Range;
Multiplication result may overflow 'unsigned int' before it is converted to 'unsigned long'.
diff --git a/crnlib/lzma/Ppmd7Enc.c b/crnlib/lzma/Ppmd7Enc.c
@@ -58,7 +58,7 @@ Z7_FORCE_INLINE
 // Z7_NO_INLINE
 static void Ppmd7z_RangeEnc_Encode(CPpmd7 *p, UInt32 start, UInt32 size)
 {
-  R->Low += start * R->Range;
+  R->Low += (UInt64)start * (UInt64)R->Range;
   R->Range *= size;
   RC_NORM_LOCAL(p)
 }

Original file line number	Diff line number	Diff line change
`@@ -58,7 +58,7 @@ Z7_FORCE_INLINE`
`58`	`58`	`// Z7_NO_INLINE`
`59`	`59`	`static void Ppmd7z_RangeEnc_Encode(CPpmd7 *p, UInt32 start, UInt32 size)`
`60`	`60`	`{`
`61`		`- R->Low += start * R->Range;`
	`61`	`+ R->Low += (UInt64)start * (UInt64)R->Range;`
`62`	`62`	`R->Range *= size;`
`63`	`63`	`RC_NORM_LOCAL(p)`
`64`	`64`	`}`