From b9cc488ad5380d4ff6b9c62d9a29165db2c63539 Mon Sep 17 00:00:00 2001
From: Sam Hocevar <sam@hocevar.net>
Date: Thu, 21 Jan 2010 01:17:15 +0000
Subject: [PATCH] Fix a buffer overflow in zzcat.

---
 src/zzcat.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/zzcat.c b/src/zzcat.c
index 5bd6cdf..565bc02 100644
--- a/src/zzcat.c
+++ b/src/zzcat.c
@@ -268,7 +268,7 @@ static void output(char const *buf, size_t len)
         sequence = strchr(sequence, ')') + 1; \
     } while(0)
 
-#define ROUNDUP(size) (((size) + 0xfff) & ~0xfff)
+#define ROUNDUP(size) (((size) + 0x1000) & ~0xfff)
 
 #define MERGE(address, cnt, off) \
     do { \
@@ -276,7 +276,7 @@ static void output(char const *buf, size_t len)
         if (_cnt && retoff + _cnt > retlen) \
         { \
             retlen = retoff + _cnt; \
-            if (ROUNDUP(retlen) != ROUNDUP(retlen - _cnt)) \
+            if (!retbuf || ROUNDUP(retlen) != ROUNDUP(retlen - _cnt)) \
                 retbuf = realloc(retbuf, ROUNDUP(retlen)); \
         } \
         if (_cnt > 0) \