Source-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS import: src/common/dist/zlib
Module Name: src
Committed By: christos
Date: Wed Nov 11 15:49:19 UTC 2026
Update of /cvsroot/src/common/dist/zlib
In directory ivanova.netbsd.org:/tmp/cvs-serv14369
Log Message:
Import zlib-1.4.0 (previous was 1.3.2) to address CVE-2026-85091
Breaking changes
- CMake:
- The minimum CMake version is now 3.15, up from 3.12.
- Library file names changed on MSVC: z is now libz, as in libz.dll,
libz.lib, and the static libzs.lib. minizip's libraries changed the
same way.
- On Cygwin, the libraries now use the lib prefix.
- Contrib targets and tests built as part of zlib are now prefixed with
zlib_. Several test targets were renamed to one scheme, for example
zlib_examplestatic and minigzipstatic.
- The zlib1.dll option ENABLE_BZIP2 is now ZLIB1_DLL_ENABLE_BZIP2.
- When not otherwise determined, z_off_t is again long, as in 1.3.1, instead
of 1.3.2's long long. Windows applications built with 1.3.2 headers should
be recompiled; see Enhancements for 64-bit offsets.
- deflateReset() now resets the gzip header set by deflateSetHeader(), as
zlib.h has always said. Code relying on the header persisting must set
it again.
- Raw deflate that completes exactly at the end of the output buffer now
returns Z_STREAM_END instead of Z_OK, as documented.
- gzopen() with "x" now fails where O_EXCL isn't available, instead of
truncating an existing file (Trail of Bits TOB-ZLIB-009).
- gzip reading now delivers the data decompressed before a read error, and
only then reports the error.
Security fixes
- Non-blocking gzwrite() had a buffer overflow; CVE-2026-85091 (reported by
mat-mo; also TOB-ZLIB-003).
- inflateGetDictionary() could write up to 8 MB past the caller's 32K buffer
(Theorem THM-ZLIB-001). This took a zlib header with an invalid window
size, then inflateReset() or inflateSync(). Affects 1.2.8 through 1.3.2.
- inflateSync() before the window size was known allocated a one-byte
window that could later be overrun (TOB-ZLIB-004).
- inflatePrime() could lead inflate() to read before the start of the input
(TOB-ZLIB-014).
- Repeated deflatePrime() calls could write past the pending buffer
(TOB-ZLIB-013).
- inflateBack() failed to detect distances too far back, and copied
uninitialized memory to the output (reported by Kornel Lesiński).
- gzseek() forward before any data was written could write uninitialized
memory to the gzip output (found by Claude Opus 5.5).
- deflateResetKeep() used mid-stream could read outside the window
(reported by Jason Gross).
- gzdopen() now sets close-on-exec with the correct flag (TOB-ZLIB-008).
- minizip:
- A double free in block_central_name() (reported by Oculytic), and a
NULL dereference on repeated zipAlreadyThere() calls after a bad central
directory (reported by Naveed Khan).
- Validation of extra-field sizes, plus portable, alignment-safe reading,
in zipRemoveExtraInfoBlock() (reported by Naveed Khan and jmestwa-coder).
- unzip no longer reads Zip64 values from outside their extra-field
record (reported by Mohamed Elnady). It also uses only the Zip64 locator
immediately before the end of central directory record (reported by
snajafov). Crafted archives could make minizip report different entries
than other readers.
- miniunz could create directories outside the extraction directory
(reported by Naveed Khan), and on Windows write files anywhere
(reported by Trail of Bits). Fixed by Naveed Khan. Path names are now
processed by component.
- contrib/infback9: removed out-of-bounds pointer arithmetic in inftree9.c;
CVE-2026-4738 (fix by npt-1707, submitted by CrossVR). The pointers return
in bounds before use and no known compiler mishandles this, so the
critical rating overstates it, though it could trap on capability hardware
such as CHERI.
Bug fixes
- gzip reading:
- Restored the detection of truncated gzip streams, part of which was lost
in 1.3.2. Also fixed a complete stream being reported as truncated.
- An error in the first member is no longer treated as trailing garbage.
- Corrected pending-skip handling in gz_skip(), gzdirect() and forced
seeks at EOF.
- gzgets() now returns an empty string when promised.
- gzip writing:
- Successive SEEK_CUR seeks no longer lose zero fill.
- Zero fill is now handled correctly after a write error.
- gzprintf() is now all-or-nothing when blocked, and is no longer a stub
when compiled as C++.
- gzseek() leaves the position unchanged on failure.
- gzopen_w() now works with paths not representable in the locale.
- inflate:
- total_in was short six bytes on Z_NEED_DICT.
- inflateReset() now restores the requested window size, and the wrap
after inflateSync().
- inflateSetDictionary() rejects a null dictionary.
- With PKZIP_BUG_WORKAROUND, the code tables were slightly too small.
- deflate:
- A bad deflateSetDictionary() call is now detected as promised.
- A failed deflateCopy() or inflateCopy() leaves the destination safe to
end.
- Removed a possible overflow in deflate_stored() comparisons.
- Undefined behavior removed in gzwrite.c, gzseek, gz_vacate() and mztools.c.
- minizip:
- zip.c no longer writes corrupt headers when a Zip64 field overflows an
extra field (reported by mzfr and itsgaldoron), or for Zip64 entries
with file comments.
- zipOpen3() no longer leaks memory or returns a freed comment pointer on
failure.
- Added allocation checks.
- Build:
- configure now builds the shared library with linkers such as lld that
reject undefined symbols in zlib.map, including for --solo.
- zlib.h no longer depends on NULL being defined.
- zip.c builds with NO_ADDFILEINEXISTINGZIP.
- The test programs use the generated zconf.h when building out of tree.
- Many CMake fixes: pkg-config files, installation of headers and of
minizip's configuration, symbol prefixing, assembler detection, and
parallel testing. It also works with CMake 4.
Enhancements
- 64-bit offsets on Windows with MSVC or MinGW, by compiling the
application with _FILE_OFFSET_BITS=64 or _LARGEFILE64_SOURCE. The library
itself needs no changes.
- Platforms:
- Android large file support.
- An export list on AIX.
- -Wno-psabi, only where the PowerPC note would appear.
- s390x VGFMAFLAG in configure.
- Win32 Makefile.msc builds for ARM64.
- minigzip's mmap code uses POSIX types.
- CMake:
- Package components, with _FOUND variables.
- Installation and export of zlib1.dll and zlibwapi.dll.
- Contribs build standalone, with zlib's defaults.
- Tests consolidated, and tests on Windows.
- minizip:
- The traditional encryption header uses a PCG generator instead of
rand().
- Fewer compiler warnings.
- Documentation:
- Clarified that undocumented functions are not part of the API.
- inflateGetHeader() header reuse.
- deflateBound() and deflateSetDictionary() ordering.
- The application's responsibilities in unzip.h.
Known issues
- contrib/iostream2 is unsafe on untrusted input (reported by Trail of
Bits). When reading a string, it uses the length stored in the compressed
data without checking it, so a crafted file can write past the end of the
destination buffer. Use contrib/iostream3 instead.
Status:
Vendor Tag: ZLIB
Release Tags: zlib-1-4-0
U src/common/dist/zlib/zutil.h
U src/common/dist/zlib/inftrees.h
C src/common/dist/zlib/inflate.c
U src/common/dist/zlib/CMakeLists.txt
U src/common/dist/zlib/zlib.map
U src/common/dist/zlib/zlib.pc.cmakein
U src/common/dist/zlib/LICENSE
U src/common/dist/zlib/zlib.3.pdf
U src/common/dist/zlib/configure
C src/common/dist/zlib/compress.c
U src/common/dist/zlib/zlib.3
U src/common/dist/zlib/ChangeLog
C src/common/dist/zlib/deflate.c
U src/common/dist/zlib/inffixed.h
U src/common/dist/zlib/Makefile
U src/common/dist/zlib/FAQ
U src/common/dist/zlib/zlibConfig.cmake.in
U src/common/dist/zlib/gzread.c
U src/common/dist/zlib/zconf.h.in
U src/common/dist/zlib/trees.h
U src/common/dist/zlib/README-cmake.md
U src/common/dist/zlib/inffast.h
U src/common/dist/zlib/treebuild.xml
C src/common/dist/zlib/crc32.c
U src/common/dist/zlib/README
C src/common/dist/zlib/infback.c
C src/common/dist/zlib/zutil.c
U src/common/dist/zlib/deflate.h
U src/common/dist/zlib/zlib.pc.in
C src/common/dist/zlib/gzguts.h
C src/common/dist/zlib/zlib.h
U src/common/dist/zlib/gzlib.c
U src/common/dist/zlib/make_vms.com
U src/common/dist/zlib/inflate.h
C src/common/dist/zlib/inftrees.c
U src/common/dist/zlib/INDEX
U src/common/dist/zlib/BUILD.bazel
C src/common/dist/zlib/uncompr.c
C src/common/dist/zlib/gzwrite.c
C src/common/dist/zlib/trees.c
U src/common/dist/zlib/MODULE.bazel
U src/common/dist/zlib/gzclose.c
U src/common/dist/zlib/.cmake-format.yaml
U src/common/dist/zlib/crc32.h
U src/common/dist/zlib/Makefile.in
U src/common/dist/zlib/inffast.c
U src/common/dist/zlib/adler32.c
C src/common/dist/zlib/zconf.h
U src/common/dist/zlib/test/CMakeLists.txt
U src/common/dist/zlib/test/infcover.c
U src/common/dist/zlib/test/find_package_wrong_components_test.cmake.in
U src/common/dist/zlib/test/find_package_test.cmake.in
U src/common/dist/zlib/test/example.c
U src/common/dist/zlib/test/find_package_no_components_test.cmake.in
U src/common/dist/zlib/test/minigzip.c
U src/common/dist/zlib/test/add_subdirectory_exclude_test.cmake.in
U src/common/dist/zlib/test/add_subdirectory_test.cmake.in
U src/common/dist/zlib/qnx/package.qpg
U src/common/dist/zlib/msdos/Makefile.bor
U src/common/dist/zlib/msdos/Makefile.msc
U src/common/dist/zlib/msdos/Makefile.emx
U src/common/dist/zlib/msdos/Makefile.dj2
U src/common/dist/zlib/msdos/Makefile.tc
U src/common/dist/zlib/os400/zlibfree.rpgle
U src/common/dist/zlib/os400/README400
U src/common/dist/zlib/os400/zlibfixed.rpgle
U src/common/dist/zlib/os400/make.sh
U src/common/dist/zlib/os400/bndsrc
U src/common/dist/zlib/doc/rfc1952.txt
U src/common/dist/zlib/doc/rfc1950.txt
U src/common/dist/zlib/doc/algorithm.txt
U src/common/dist/zlib/doc/rfc1951.txt
U src/common/dist/zlib/doc/txtvsbin.txt
U src/common/dist/zlib/doc/crc-doc.1.0.pdf
U src/common/dist/zlib/contrib/CMakeLists.txt
U src/common/dist/zlib/contrib/README.contrib
U src/common/dist/zlib/contrib/ada/buffer_demo.adb
U src/common/dist/zlib/contrib/ada/CMakeLists.txt
U src/common/dist/zlib/contrib/ada/zlib-streams.ads
U src/common/dist/zlib/contrib/ada/zlib-thin.ads
U src/common/dist/zlib/contrib/ada/zlib.adb
U src/common/dist/zlib/contrib/ada/read.adb
U src/common/dist/zlib/contrib/ada/mtest.adb
U src/common/dist/zlib/contrib/ada/test.adb
U src/common/dist/zlib/contrib/ada/zlib.gpr
U src/common/dist/zlib/contrib/ada/zlib-thin.adb
U src/common/dist/zlib/contrib/ada/zlib-streams.adb
U src/common/dist/zlib/contrib/ada/zlib.ads
U src/common/dist/zlib/contrib/ada/readme.txt
N src/common/dist/zlib/contrib/ada/test/CMakeLists.txt
U src/common/dist/zlib/contrib/ada/cmake/static_link_helper.cmake
U src/common/dist/zlib/contrib/ada/cmake/binder_helper.cmake
U src/common/dist/zlib/contrib/ada/cmake/compile_helper.cmake
U src/common/dist/zlib/contrib/ada/cmake/shared_link_helper.cmake
U src/common/dist/zlib/contrib/ada/cmake/exe_link_helper.cmake
U src/common/dist/zlib/contrib/ada/cmake/Modules/CMakeADAInformation.cmake
U src/common/dist/zlib/contrib/ada/cmake/Modules/CMakeDetermineADACompiler.cmake
U src/common/dist/zlib/contrib/ada/cmake/Modules/CMakeADACompiler.cmake.in
U src/common/dist/zlib/contrib/ada/cmake/Modules/CMakeTestADACompiler.cmake
U src/common/dist/zlib/contrib/pascal/example.pas
U src/common/dist/zlib/contrib/pascal/zlibpas.pas
U src/common/dist/zlib/contrib/pascal/readme.txt
U src/common/dist/zlib/contrib/pascal/zlibd32.mak
U src/common/dist/zlib/contrib/dotzlib/DotZLib.build
U src/common/dist/zlib/contrib/dotzlib/LICENSE_1_0.txt
U src/common/dist/zlib/contrib/dotzlib/DotZLib.chm
U src/common/dist/zlib/contrib/dotzlib/readme.txt
U src/common/dist/zlib/contrib/dotzlib/DotZLib.sln
U src/common/dist/zlib/contrib/dotzlib/DotZLib/GZipStream.cs
U src/common/dist/zlib/contrib/dotzlib/DotZLib/CodecBase.cs
U src/common/dist/zlib/contrib/dotzlib/DotZLib/CircularBuffer.cs
U src/common/dist/zlib/contrib/dotzlib/DotZLib/AssemblyInfo.cs
U src/common/dist/zlib/contrib/dotzlib/DotZLib/UnitTests.cs
U src/common/dist/zlib/contrib/dotzlib/DotZLib/DotZLib.cs
U src/common/dist/zlib/contrib/dotzlib/DotZLib/ChecksumImpl.cs
U src/common/dist/zlib/contrib/dotzlib/DotZLib/DotZLib.csproj
U src/common/dist/zlib/contrib/dotzlib/DotZLib/Deflater.cs
U src/common/dist/zlib/contrib/dotzlib/DotZLib/Inflater.cs
U src/common/dist/zlib/contrib/crc32vx/CMakeLists.txt
U src/common/dist/zlib/contrib/crc32vx/crc32_vx_hooks.h
U src/common/dist/zlib/contrib/crc32vx/README
U src/common/dist/zlib/contrib/crc32vx/crc32_vx.c
U src/common/dist/zlib/contrib/vstudio/readme.txt
U src/common/dist/zlib/contrib/minizip/skipset.h
U src/common/dist/zlib/contrib/minizip/minizipConfig.cmake.in
U src/common/dist/zlib/contrib/minizip/configure.ac
U src/common/dist/zlib/contrib/minizip/MiniZip64_Changes.txt
U src/common/dist/zlib/contrib/minizip/CMakeLists.txt
U src/common/dist/zlib/contrib/minizip/unzip.c
U src/common/dist/zlib/contrib/minizip/minizip.pc.txt
U src/common/dist/zlib/contrib/minizip/zip.c
U src/common/dist/zlib/contrib/minizip/iowin32.h
U src/common/dist/zlib/contrib/minizip/Makefile
U src/common/dist/zlib/contrib/minizip/ioapi.c
U src/common/dist/zlib/contrib/minizip/LICENSE.Info-Zip
U src/common/dist/zlib/contrib/minizip/mztools.c
U src/common/dist/zlib/contrib/minizip/MiniZip64_info.txt
U src/common/dist/zlib/contrib/minizip/minizip.pc.in
U src/common/dist/zlib/contrib/minizip/minizip.1
U src/common/dist/zlib/contrib/minizip/Makefile.am
U src/common/dist/zlib/contrib/minizip/crypt.h
U src/common/dist/zlib/contrib/minizip/zip.h
U src/common/dist/zlib/contrib/minizip/ints.h
U src/common/dist/zlib/contrib/minizip/make_vms.com
U src/common/dist/zlib/contrib/minizip/unzip.h
U src/common/dist/zlib/contrib/minizip/miniunzip.1
U src/common/dist/zlib/contrib/minizip/mztools.h
U src/common/dist/zlib/contrib/minizip/ioapi.h
U src/common/dist/zlib/contrib/minizip/iowin32.c
U src/common/dist/zlib/contrib/minizip/minizip.c
U src/common/dist/zlib/contrib/minizip/miniunz.c
U src/common/dist/zlib/contrib/minizip/test/CMakeLists.txt
U src/common/dist/zlib/contrib/minizip/test/find_package_wrong_components_test.cmake.in
U src/common/dist/zlib/contrib/minizip/test/find_package_test.cmake.in
U src/common/dist/zlib/contrib/minizip/test/find_package_no_components_test.cmake.in
U src/common/dist/zlib/contrib/minizip/test/add_subdirectory_exclude_test.cmake.in
U src/common/dist/zlib/contrib/minizip/test/add_subdirectory_test.cmake.in
U src/common/dist/zlib/contrib/minizip/test/test_helper.cm
U src/common/dist/zlib/contrib/delphi/ZLibConst.pas
U src/common/dist/zlib/contrib/delphi/ZLib.pas
U src/common/dist/zlib/contrib/delphi/readme.txt
U src/common/dist/zlib/contrib/delphi/zlibd32.mak
N src/common/dist/zlib/contrib/zlib1-dll/zlibwapi.rc
N src/common/dist/zlib/contrib/zlib1-dll/zlib1dllConfig.cmake.in
U src/common/dist/zlib/contrib/zlib1-dll/CMakeLists.txt
U src/common/dist/zlib/contrib/zlib1-dll/readme.txt
N src/common/dist/zlib/contrib/zlib1-dll/zlib1.rc
N src/common/dist/zlib/contrib/zlib1-dll/test/CMakeLists.txt
N src/common/dist/zlib/contrib/zlib1-dll/test/find_package_test.cmake.in
N src/common/dist/zlib/contrib/zlib1-dll/test/add_subdirectory_exclude_test.cmake.in
N src/common/dist/zlib/contrib/zlib1-dll/test/add_subdirectory_test.cmake.in
U src/common/dist/zlib/contrib/infback9/inffix9.h
U src/common/dist/zlib/contrib/infback9/inftree9.c
U src/common/dist/zlib/contrib/infback9/CMakeLists.txt
U src/common/dist/zlib/contrib/infback9/infback9.h
U src/common/dist/zlib/contrib/infback9/README
U src/common/dist/zlib/contrib/infback9/inflate9.h
U src/common/dist/zlib/contrib/infback9/infback9.c
U src/common/dist/zlib/contrib/infback9/inftree9.h
U src/common/dist/zlib/contrib/gcc_gvmat64/CMakeLists.txt
U src/common/dist/zlib/contrib/gcc_gvmat64/gvmat64.S
U src/common/dist/zlib/contrib/testzlib/CMakeLists.txt
U src/common/dist/zlib/contrib/testzlib/testzlib.txt
U src/common/dist/zlib/contrib/testzlib/testzlib.c
U src/common/dist/zlib/contrib/nuget/nuget.sln
U src/common/dist/zlib/contrib/nuget/nuget.csproj
U src/common/dist/zlib/contrib/iostream/test.cpp
U src/common/dist/zlib/contrib/iostream/zfstream.cpp
U src/common/dist/zlib/contrib/iostream/zfstream.h
U src/common/dist/zlib/contrib/blast/CMakeLists.txt
U src/common/dist/zlib/contrib/blast/blast.c
U src/common/dist/zlib/contrib/blast/Makefile
U src/common/dist/zlib/contrib/blast/blast-test.c
U src/common/dist/zlib/contrib/blast/README
U src/common/dist/zlib/contrib/blast/blast.h
U src/common/dist/zlib/contrib/blast/blastConfig.cmake.in
U src/common/dist/zlib/contrib/blast/test/CMakeLists.txt
U src/common/dist/zlib/contrib/blast/test/find_package_wrong_components_test.cmake.in
N src/common/dist/zlib/contrib/blast/test/test.pk
U src/common/dist/zlib/contrib/blast/test/find_package_test.cmake.in
U src/common/dist/zlib/contrib/blast/test/find_package_no_components_test.cmake.in
N src/common/dist/zlib/contrib/blast/test/test.txt
U src/common/dist/zlib/contrib/blast/test/add_subdirectory_exclude_test.cmake.in
N src/common/dist/zlib/contrib/blast/test/tester.cmake
U src/common/dist/zlib/contrib/blast/test/add_subdirectory_test.cmake.in
U src/common/dist/zlib/contrib/puff/bin-writer.c
U src/common/dist/zlib/contrib/puff/CMakeLists.txt
U src/common/dist/zlib/contrib/puff/puffConfig.cmake.in
U src/common/dist/zlib/contrib/puff/Makefile
U src/common/dist/zlib/contrib/puff/puff.h
U src/common/dist/zlib/contrib/puff/README
U src/common/dist/zlib/contrib/puff/pufftest.c
U src/common/dist/zlib/contrib/puff/puff.c
U src/common/dist/zlib/contrib/puff/zeros.raw
U src/common/dist/zlib/contrib/puff/test/CMakeLists.txt
U src/common/dist/zlib/contrib/puff/test/tester-cov.cmake
U src/common/dist/zlib/contrib/puff/test/find_package_wrong_components_test.cmake.in
U src/common/dist/zlib/contrib/puff/test/find_package_test.cmake.in
U src/common/dist/zlib/contrib/puff/test/find_package_no_components_test.cmake.in
U src/common/dist/zlib/contrib/puff/test/add_subdirectory_exclude_test.cmake.in
U src/common/dist/zlib/contrib/puff/test/tester.cmake
U src/common/dist/zlib/contrib/puff/test/add_subdirectory_test.cmake.in
U src/common/dist/zlib/contrib/iostream3/iostream3Config.cmake.in
U src/common/dist/zlib/contrib/iostream3/CMakeLists.txt
U src/common/dist/zlib/contrib/iostream3/zfstream.cc
U src/common/dist/zlib/contrib/iostream3/zfstream.h
U src/common/dist/zlib/contrib/iostream3/README
U src/common/dist/zlib/contrib/iostream3/TODO
U src/common/dist/zlib/contrib/iostream3/test.cc
U src/common/dist/zlib/contrib/iostream3/test/CMakeLists.txt
U src/common/dist/zlib/contrib/iostream3/test/find_package_wrong_components_test.cmake.in
U src/common/dist/zlib/contrib/iostream3/test/find_package_test.cmake.in
U src/common/dist/zlib/contrib/iostream3/test/find_package_no_components_test.cmake.in
U src/common/dist/zlib/contrib/iostream3/test/add_subdirectory_exclude_test.cmake.in
U src/common/dist/zlib/contrib/iostream3/test/add_subdirectory_test.cmake.in
U src/common/dist/zlib/contrib/iostream2/zstream.h
U src/common/dist/zlib/contrib/iostream2/zstream_test.cpp
U src/common/dist/zlib/examples/gznorm.c
U src/common/dist/zlib/examples/fitblk.c
U src/common/dist/zlib/examples/enough.c
U src/common/dist/zlib/examples/gzlog.h
U src/common/dist/zlib/examples/gzjoin.c
U src/common/dist/zlib/examples/gun.c
U src/common/dist/zlib/examples/zran.h
U src/common/dist/zlib/examples/README.examples
U src/common/dist/zlib/examples/zlib_how.html
U src/common/dist/zlib/examples/zpipe.c
U src/common/dist/zlib/examples/gzlog.c
U src/common/dist/zlib/examples/zran.c
U src/common/dist/zlib/examples/gzappend.c
U src/common/dist/zlib/amiga/Makefile.sas
U src/common/dist/zlib/amiga/Makefile.pup
U src/common/dist/zlib/win32/VisualC.txt
U src/common/dist/zlib/win32/Makefile.bor
U src/common/dist/zlib/win32/Makefile.msc
U src/common/dist/zlib/win32/zlib.def
U src/common/dist/zlib/win32/DLL_FAQ.txt
U src/common/dist/zlib/win32/README-WIN32.txt
N src/common/dist/zlib/win32/zlib-cmake.rc
U src/common/dist/zlib/win32/Makefile.gcc
U src/common/dist/zlib/win32/zlib1.rc
U src/common/dist/zlib/watcom/watcom_f.mak
U src/common/dist/zlib/watcom/watcom_l.mak
13 conflicts created by this import.
Use the following command to help the merge:
cvs checkout -jZLIB:yesterday -jZLIB src/common/dist/zlib
Home |
Main Index |
Thread Index |
Old Index