Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 8 Aug 2022 18:31:59 -0700
From: Alan Coopersmith <>
Cc: Evgeny Legerov <>
Subject: Re: zlib buffer overflow

On 8/5/22 13:53, Evgeny Legerov wrote:
> Heap overflow has been fixed in zlib - 

Expanding this for the benefit of list members and the archives:

The CVE description is:

    zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow
    in inflate in inflate.c via a large gzip header extra field.

    NOTE: only applications that call inflateGetHeader are affected. Some
    common applications bundle the affected zlib source code but may be unable
    to call inflateGetHeader (e.g., see the nodejs/node reference).

where the nodejs reference is to:

The reproducer is posted at and
notes the issue was found by Evgeny Legerov of @intevydis - who is
presumably our original poster here.

The initial fix upstream was:

     If the extra field was larger than the space the user provided with
     inflateGetHeader(), and if multiple calls of inflate() delivered
     the extra header data, then there could be a buffer overflow of the
     provided space. This commit assures that provided space is not


*but* the curl developers found that crashed in their testing, as reported
in comments on the above commit and
so a followup fix upstream today made sure not to dereference state->head
until *after* the check for it not being NULL:

         -Alan Coopersmith-       
          Oracle Solaris Engineering -

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.