compress/flate: Writer with a preset dictionary emits the dictionary into the output stream [1.27 backport]

[gopherbot]

@FZambia requested issue #80538 to be considered for backport to the next 1.27 minor release.

@gopherbot Please backport to go1.27. This causes silent output corruption (or a spurious checksum error with zlib) for preset-dictionary flate/zlib writers at compression level ≥2 whenever the input doesn't compress well enough to beat a raw stored block — a data-integrity issue, not just a compression-ratio regression.

[prattmic]

@klauspost since you didn't get a chance to look at https://go.dev/cl/804680 before it was merged, it would be great to get your feedback here that it looks good before we backport.

[klauspost]

@prattmic Yeah, it was already merged when I got to a keyboard. I didn't see any issues and I wrongly assumed it would be included in the release, so didn't think more of it. So didn't want to add LGTM noise.

But it seems like we missed another release window now :(

The fix looks good. I will add a fuzz check for dictionaries in my own version and see if anything else comes up.

[prattmic]

But it seems like we missed another release window now :(

FWIW, we'd already frozen which backports were going into 1.27.1 when this backport request was made 3 days ago. It looks like we generally dropped the ball all around on noticing that CL needed to go into 1.27.0 back when it was merged.

[klauspost]

Backported the fix with a fuzz tests for dictionaries:

...
fuzz: elapsed: 22h55m0s, execs: 1166350699 (37560/sec), new interesting: 189 (total: 3806)
fuzz: elapsed: 22h55m2s, execs: 1166420484 (38358/sec), new interesting: 189 (total: 3806)
PASS
ok      github.com/klauspost/compress/flate     82520.249s

Makes me pretty confident there are no side-effects or other similar issues.

[klauspost]

Should I do the backport? I expect it to be purely a cherry pick.

[prattmic]

Sure! Instructions are at https://go.dev/wiki/MinorReleases#making-cherry-pick-cls

[klauspost]

Note that only the authors of the original CL and approvers have the ability to create the cherry-pick.

I think that means we need @joechenrh or someone from the team to open it, no?