Skip to content

Conversation

@folkertdev
Copy link
Contributor

fixes a stack overflow on malicious input GHSA-j3px-q95c-9683

#[cfg(feature = "zlib-ng")]
const ZLIB_VERSION: &'static str = "2.1.0.devel\0";
#[cfg(all(not(feature = "zlib-ng"), feature = "zlib-rs"))]
const ZLIB_VERSION: &'static str = "1.3.0-zlib-rs-0.3.0\0";
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this bump is not strictly needed here (only the 1.3.0 part is relevant, and I believe only the 1 prefix is checked by most zlib libraries (but applications might check more).

Copy link
Member

@Byron Byron left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot for the fix and the update here - I will create a new release right away.

@Byron Byron merged commit 14aec22 into rust-lang:main Nov 14, 2024
14 checks passed
@Byron
Copy link
Member

Byron commented Nov 14, 2024

@folkertdev
Copy link
Contributor Author

nice, thanks!

(btw we're now also testing with the flate2 test suite in CI trifectatechfoundation/zlib-rs#250)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants