Skip to content

Conversation

folkertdev
Copy link
Contributor

fixes a stack overflow on malicious input GHSA-j3px-q95c-9683

@@ -447,7 +447,7 @@ mod c_backend {
#[cfg(feature = "zlib-ng")]
const ZLIB_VERSION: &'static str = "2.1.0.devel\0";
#[cfg(all(not(feature = "zlib-ng"), feature = "zlib-rs"))]
const ZLIB_VERSION: &'static str = "1.3.0-zlib-rs-0.3.0\0";
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this bump is not strictly needed here (only the 1.3.0 part is relevant, and I believe only the 1 prefix is checked by most zlib libraries (but applications might check more).

Copy link
Member

@Byron Byron left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot for the fix and the update here - I will create a new release right away.

@Byron Byron merged commit 14aec22 into rust-lang:main Nov 14, 2024
14 checks passed
@Byron
Copy link
Member

Byron commented Nov 14, 2024

@folkertdev
Copy link
Contributor Author

nice, thanks!

(btw we're now also testing with the flate2 test suite in CI trifectatechfoundation/zlib-rs#250)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants