Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

upgrade zlib-rs to version 0.4.0 #439

Merged
merged 1 commit into from
Nov 14, 2024

Conversation

folkertdev
Copy link
Contributor

fixes a stack overflow on malicious input GHSA-j3px-q95c-9683

@@ -447,7 +447,7 @@ mod c_backend {
#[cfg(feature = "zlib-ng")]
const ZLIB_VERSION: &'static str = "2.1.0.devel\0";
#[cfg(all(not(feature = "zlib-ng"), feature = "zlib-rs"))]
const ZLIB_VERSION: &'static str = "1.3.0-zlib-rs-0.3.0\0";
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this bump is not strictly needed here (only the 1.3.0 part is relevant, and I believe only the 1 prefix is checked by most zlib libraries (but applications might check more).

Copy link
Member

@Byron Byron left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot for the fix and the update here - I will create a new release right away.

@Byron Byron merged commit 14aec22 into rust-lang:main Nov 14, 2024
14 checks passed
@Byron
Copy link
Member

Byron commented Nov 14, 2024

@folkertdev
Copy link
Contributor Author

nice, thanks!

(btw we're now also testing with the flate2 test suite in CI trifectatechfoundation/zlib-rs#250)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants