Commit e9415f7 for zlib
commit e9415f70eb6a37c4b6b9685b12e8e6ac91c80f54
Author: Mark Adler <git@madler.net>
Date: Sun Oct 25 18:29:35 2026 -0700
Avoid writing uninitialized data on a gzip zero fill.
Before, data could be compressed and written to the output from an
uninitialized allocation of memory, possibly exposing internal
data from the application. This would only occur if gzseek() was
used to skip forward before any data had been written, and the next
operation was gzputc(), gzflush(), gzsetparams(), or gzclose().
Now zeros are written.
diff --git a/gzwrite.c b/gzwrite.c
index f3343a0..27019b8 100644
--- a/gzwrite.c
+++ b/gzwrite.c
@@ -156,6 +156,11 @@ local int gz_zero(gz_statep state) {
unsigned n;
z_streamp strm = &(state->strm);
+ /* allocate memory if this is the first time through -- the input buffer
+ must exist before it is zeroed below */
+ if (state->size == 0 && gz_init(state) == -1)
+ return -1;
+
/* consume whatever's left in the input buffer */
if (strm->avail_in && gz_comp(state, Z_NO_FLUSH) == -1)
return -1;