Index: lib/libz/deflate.c
===================================================================
RCS file: /home/ncvs/src/lib/libz/deflate.c,v
retrieving revision 1.5
diff -u -r1.5 deflate.c
--- lib/libz/deflate.c	28 Aug 1999 00:06:01 -0000	1.5
+++ lib/libz/deflate.c	21 Mar 2002 01:52:14 -0000
@@ -242,7 +242,7 @@
         windowBits = -windowBits;
     }
     if (memLevel < 1 || memLevel > MAX_MEM_LEVEL || method != Z_DEFLATED ||
-        windowBits < 8 || windowBits > 15 || level < 0 || level > 9 ||
+        windowBits < 9 || windowBits > 15 || level < 0 || level > 9 ||
 	strategy < 0 || strategy > Z_HUFFMAN_ONLY) {
         return Z_STREAM_ERROR;
     }
Index: lib/libz/infblock.c
===================================================================
RCS file: /home/ncvs/src/lib/libz/infblock.c,v
retrieving revision 1.1.1.4
diff -u -r1.1.1.4 lib/libz/infblock.c
--- lib/libz/infblock.c	10 Jan 1999 09:46:55 -0000	1.1.1.4
+++ lib/libz/infblock.c	21 Mar 2002 04:01:03 -0000
@@ -249,10 +249,11 @@
                              &s->sub.trees.tb, s->hufts, z);
       if (t != Z_OK)
       {
-        ZFREE(z, s->sub.trees.blens);
         r = t;
-        if (r == Z_DATA_ERROR)
+        if (r == Z_DATA_ERROR) {
+          ZFREE(z, s->sub.trees.blens);
           s->mode = BAD;
+	}
         LEAVE
       }
       s->sub.trees.index = 0;
@@ -313,11 +314,12 @@
         t = inflate_trees_dynamic(257 + (t & 0x1f), 1 + ((t >> 5) & 0x1f),
                                   s->sub.trees.blens, &bl, &bd, &tl, &td,
                                   s->hufts, z);
-        ZFREE(z, s->sub.trees.blens);
         if (t != Z_OK)
         {
-          if (t == (uInt)Z_DATA_ERROR)
+          if (t == (uInt)Z_DATA_ERROR) {
+            ZFREE(z, s->sub.trees.blens);
             s->mode = BAD;
+	}
           r = t;
           LEAVE
         }
@@ -329,6 +331,7 @@
         }
         s->sub.decode.codes = c;
       }
+      ZFREE(z, s->sub.trees.blens);
       s->mode = CODES;
     case CODES:
       UPDATE
Index: sys/net/zlib.c
===================================================================
RCS file: /home/ncvs/src/sys/net/zlib.c,v
retrieving revision 1.10
diff -u -r1.10 zlib.c
--- sys/net/zlib.c	29 Dec 1999 04:38:38 -0000	1.10
+++ sys/net/zlib.c	21 Mar 2002 01:52:14 -0000
@@ -776,7 +776,7 @@
         windowBits = -windowBits;
     }
     if (memLevel < 1 || memLevel > MAX_MEM_LEVEL || method != Z_DEFLATED ||
-        windowBits < 8 || windowBits > 15 || level < 0 || level > 9 ||
+        windowBits < 9 || windowBits > 15 || level < 0 || level > 9 ||
 	strategy < 0 || strategy > Z_HUFFMAN_ONLY) {
         return Z_STREAM_ERROR;
     }
@@ -3864,10 +3864,11 @@
                              &s->sub.trees.tb, z);
       if (t != Z_OK)
       {
-        ZFREE(z, s->sub.trees.blens);
         r = t;
-        if (r == Z_DATA_ERROR)
+        if (r == Z_DATA_ERROR) {
+          ZFREE(z, s->sub.trees.blens);
           s->mode = BADB;
+        }
         LEAVE
       }
       s->sub.trees.index = 0;
@@ -3932,11 +3933,12 @@
 #endif
         t = inflate_trees_dynamic(257 + (t & 0x1f), 1 + ((t >> 5) & 0x1f),
                                   s->sub.trees.blens, &bl, &bd, &tl, &td, z);
-        ZFREE(z, s->sub.trees.blens);
         if (t != Z_OK)
         {
-          if (t == (uInt)Z_DATA_ERROR)
+          if (t == (uInt)Z_DATA_ERROR) {
+            ZFREE(z, s->sub.trees.blens);
             s->mode = BADB;
+          }
           r = t;
           LEAVE
         }
@@ -3949,6 +3951,11 @@
           r = Z_MEM_ERROR;
           LEAVE
         }
+	/*
+	 * this ZFREE must occur *BEFORE* we mess with sub.decode, because
+	 * sub.trees is union'd with sub.decode.
+	 */
+        ZFREE(z, s->sub.trees.blens);
         s->sub.decode.codes = c;
         s->sub.decode.tl = tl;
         s->sub.decode.td = td;