Skip to content

Conversation

olliwang
Copy link

This pull request adds support for zlib v1.3.1.

It is an update based on the existing hunter-1.3.0 branch. The underlying zlib source code is from the official v1.3.1 release.

Changes are confined to the Hunter-specific CMake configuration files (CMakeLists.txt and cmake/Config.cmake.in).

Tested and confirmed working on macOS.

madler and others added 30 commits August 18, 2023 13:23
Also replaced Itanium with ARM and ARM64 configurations.
They were added in the VS2022 commit, but failed when run.
This checks the lengths of the file name, extra field, and comment
that would be put in the zip headers, and rejects them if they are
too long. They are each limited to 65535 bytes in length by the zip
format. This also avoids possible buffer overflows if the provided
fields are too long.
This makes it consistent with the other vstudio projects, which
use the version number.
To avoid warnings when building with -Wmissing-prototypes.
A bug fix in zlib 1.2.12 resulted in a slight slowdown (1-2%) of
deflate. This commit provides the option to #define LIT_MEM, which
uses more memory to reverse most of that slowdown. The memory for
the pending buffer and symbol buffers is increased by 25%, which
increases the total memory usage with the default parameters by
about 6%.
The appnote says that if the number of entries in the end record
is 0xffff, then the actual number of entries will be found in the
Zip64 end record. Therefore if the number of entries is equal to
0xffff, it can't be in the end record by itself, since that is an
instruction to get the number from the Zip64 end record. This code
would just store 0xffff in the end record in that case, not making
a Zip64 end record. This commit fixes that.
fdopen() is not used by zlib anymore. The #defines are vestigial.
Since each element in s->d_buf is 2 bytes, the sx index should be
multiplied by 2 in the assert.

Fixes madler#897
If it is negative, then the code will enter an infinite loop.
Archive formats such as .zip files are generally susceptible to
so-called "traversal attacks". This allows an attacker to craft
an archive that writes to unexpected locations of the file system
(e.g., /etc/shadow) if an unspecting root user were to unpack a
malicious archive.

This patch neutralizes absolute paths such as /tmp/moo and deeply
relative paths such as dummy/../../../../../../../../../../tmp/moo

The Debian project requested CVE-2014-9485 be allocated for the
first identified weakness. The fix was incomplete, resulting in a
revised patch applied here. Since there wasn't an updated version
released by Debian with the incomplete fix, I suggest we use this
CVE to identify both issues.

Link: https://security.snyk.io/research/zip-slip-vulnerability
Link: https://bugs.debian.org/774321
Link: https://bugs.debian.org/776831
Link: https://nvd.nist.gov/vuln/detail/CVE-2014-9485
Reported-by: Jakub Wilk <jwilk@debian.org>
Fixed-by: Michael Gilbert <mgilbert@debian.org>
speedym and others added 15 commits January 17, 2024 16:07
gz_intmax() is noted in zlib.map. This assures it's always there.
There used to be one, but no more. It is up to the user or vendor
to compile zlib.
The --version-script linker option is not supported by the linker on AIX systems
This avoids trying to compare a match starting one byte before the
current window. Thanks to @zmodem (Hans) for discovering this.
Not all C compilers have a -w option.
This enables the addition of zlib to other projects.
@NeroBurner
Copy link

Merged and released: https://github.com/cpp-pm/zlib/releases/tag/v1.3.1-p0

I took the liberty to edit the commit message with more info

Thanks!

@NeroBurner NeroBurner closed this Sep 18, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.