From ddebf51c648faca255784dc231b2c3c56247587c Mon Sep 17 00:00:00 2001
From: mapengyuan <mapengyuan@xfusion.com>
Date: Wed, 29 Jul 2026 22:14:00 +0800
Subject: [PATCH] Fix segmentation fault in gzungetc() reported by OSS-Fuzz

Signed-off-by: mapengyuan <mapengyuan@xfusion.com>
---
 gzread.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/gzread.c b/gzread.c
index 8b3e369dac..ec9e4e0860 100644
--- a/gzread.c
+++ b/gzread.c
@@ -531,6 +531,8 @@ int ZEXPORT gzungetc(int c, gzFile file) {
 
     /* if output buffer empty, put byte at end (allows more pushing) */
     if (state->x.have == 0) {
+        if (state->out == NULL || state->size == 0)
+            return -1;
         state->x.have = 1;
         state->x.next = state->out + (state->size << 1) - 1;
         state->x.next[0] = (unsigned char)c;