From 6e29a4a7ca87638ddb5b6ae03fafa415ad242bf5 Mon Sep 17 00:00:00 2001
From: cjee21 <77721854+cjee21@users.noreply.github.com>
Date: Wed, 3 Jun 2026 21:24:10 +0800
Subject: [PATCH 1/2] Bitstream: Prevent array overreads and undefined
 behaviour

---
 Source/ZenLib/BitStream_Fast.h | 18 ++++++++++++++++++
 Source/ZenLib/BitStream_LE.h   | 16 ++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/Source/ZenLib/BitStream_Fast.h b/Source/ZenLib/BitStream_Fast.h
index 9706333..455259e 100644
--- a/Source/ZenLib/BitStream_Fast.h
+++ b/Source/ZenLib/BitStream_Fast.h
@@ -80,6 +80,9 @@ class BitStream_Fast
             0x1f, 0x3f, 0x7f, 0xff,
         };
 
+        if (HowMany==0 || HowMany>8)
+            return 0;
+
         if (HowMany<=(Buffer_Size%8))
         {
             Buffer_Size-=HowMany;
@@ -117,6 +120,9 @@ class BitStream_Fast
             0x1fff, 0x3fff, 0x7fff, 0xffff,
         };
 
+        if (HowMany==0 || HowMany>16)
+            return 0;
+
         if (HowMany<=(Buffer_Size%8))
         {
             Buffer_Size-=HowMany;
@@ -164,6 +170,9 @@ class BitStream_Fast
             0x1fffffff, 0x3fffffff, 0x7fffffff, 0xffffffff,
         };
 
+        if (HowMany==0 || HowMany>32)
+            return 0;
+
         if (HowMany<=(Buffer_Size%8))
         {
             Buffer_Size-=HowMany;
@@ -263,6 +272,9 @@ class BitStream_Fast
             0x1f, 0x3f, 0x7f, 0xff,
         };
 
+        if (HowMany==0 || HowMany>8)
+            return 0;
+
         if (HowMany<=(Buffer_Size%8))
             return (LastByte>>((Buffer_Size-HowMany)%8))&Mask[HowMany];
 
@@ -295,6 +307,9 @@ class BitStream_Fast
             0x1fff, 0x3fff, 0x7fff, 0xffff,
         };
 
+        if (HowMany==0 || HowMany>16)
+            return 0;
+
         if (HowMany<=(Buffer_Size%8))
             return (LastByte>>((Buffer_Size-HowMany)%8))&Mask[HowMany];
 
@@ -341,6 +356,9 @@ class BitStream_Fast
             0x1fffffff, 0x3fffffff, 0x7fffffff, 0xffffffff,
         };
 
+        if (HowMany==0 || HowMany>32)
+            return 0;
+
         if (HowMany<=(Buffer_Size%8))
             return (LastByte>>((Buffer_Size-HowMany)%8))&Mask[HowMany];
 
diff --git a/Source/ZenLib/BitStream_LE.h b/Source/ZenLib/BitStream_LE.h
index 20147c0..59dc995 100644
--- a/Source/ZenLib/BitStream_LE.h
+++ b/Source/ZenLib/BitStream_LE.h
@@ -65,6 +65,10 @@ class BitStream_LE : public BitStream
           0x01ffffff, 0x03ffffff, 0x07ffffff, 0x0fffffff,
           0x1fffffff, 0x3fffffff, 0x7fffffff, 0xffffffff,
         };
+
+        if (HowMany==0 || HowMany>32)
+            return 0;
+
         unsigned long m=Mask[HowMany];
 
         HowMany+=endbit;
@@ -103,6 +107,18 @@ class BitStream_LE : public BitStream
 
     void Skip(size_t bits)
     {
+        if (bits==0)
+            return;
+        if (bits>32) //Get is only for <=32 bits
+        {
+            do {
+                Get(32);
+                bits-=32;
+            } while (bits>32);
+            if (bits)
+                Get(bits);
+            return;
+        }
         Get(bits);
     }
 

From 736e6e4337063207f40ae94482d7340d22d16260 Mon Sep 17 00:00:00 2001
From: cjee21 <77721854+cjee21@users.noreply.github.com>
Date: Thu, 4 Jun 2026 16:51:10 +0800
Subject: [PATCH 2/2] BitstreamLE: Fix Byte_Align

---
 Source/ZenLib/BitStream_LE.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Source/ZenLib/BitStream_LE.h b/Source/ZenLib/BitStream_LE.h
index 59dc995..7385bbe 100644
--- a/Source/ZenLib/BitStream_LE.h
+++ b/Source/ZenLib/BitStream_LE.h
@@ -130,7 +130,7 @@ class BitStream_LE : public BitStream
     void Byte_Align()
     {
         if (endbit)
-            Get(endbit);
+            Get(8-endbit);
     };
 
     size_t Offset_Get()