Skip to content

Avoid overflow after a stalled gzprintf write. - #1304

Open
samuelgirmametaferia wants to merge 1 commit into
madler:developfrom
samuelgirmametaferia:fix/nonblocking-gzwrite-buffer-state
Open

Avoid overflow after a stalled gzprintf write.#1304
samuelgirmametaferia wants to merge 1 commit into
madler:developfrom
samuelgirmametaferia:fix/nonblocking-gzwrite-buffer-state

Conversation

@samuelgirmametaferia

Copy link
Copy Markdown

This fixes an overflow in the buffered gzwrite() path after a non-blocking gzprintf() stalls with more than state->size bytes pending in the double-sized input buffer.

Previously, the small-write path computed state->size - have without first handling have >= state->size, so the subtraction could underflow and lead to a copy past the input allocation. The fix first attempts to drain the pending input with gz_comp() and returns the non-blocking stall without consuming caller input when the output cannot make progress.

A focused regression test fills a non-blocking pipe, uses a small gzip buffer, performs two gzprintf() calls to reach the stalled state, and verifies that a following gzwrite() consumes no input.

Validation performed locally:

  • static CMake build passes;
  • all 14 CTest tests pass, including the new zlib_gzprintfwrite test;
  • the regression test fails against the unpatched base;
  • ASan reproduces the heap-buffer-overflow before the fix and no overflow occurs on the corrected path.

@samuelgirmametaferia

Copy link
Copy Markdown
Author

Hey could you please review this!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant