Proposals / #658

Type ZLIB_InflateTable’s lengths and output-table cursor

applied · by Commit-Will · submitted 2026-11-01, applied 2026-11-01

Ghidra v1797 · 3bccb89

Two argument types disagree with every caller and the complete body. EDX pBitLengths is a ushort array: all three calls pass inflate_state.lens (+0x70) or lens+nlen with scale2; all five input accesses are WORD reads/zero tests, with MOVZX for values. Stack8 ppOutTable points to the state.next cursor, initialized from the existing inflate_code codes[] array. The target dereferences that pointer slot, writes code entries as BYTE+0/BYTE+1/WORD+2, and advances the slot by entries*4, matching existing inflate_code. Full target1133 bytes, caller5424 bytes, producer190 bytes and all35 caller switch entries were checked against original Windows PE bytes; full CFG confirms state/input provenance at each call. Retype only pBitLengths to ushort* and ppOutTable to inflate_code**, preserving all chosen names, six storage slots, int return and fastcall. No shared field/type edit or runtime/byte-match benefit is claimed.

Changes 2, applied together

1. Retype variable win 0x0042e120 EDX

   typeint32_t→ushort *

2. Retype variable win 0x0042e120 Stack[0x8]

   typeint *→inflate_code * *