Commit 2fd31f0 for zlib

commit 2fd31f00740ea183b640f3f5c12659420e189c76
Author: Jason Gross <jason@theorem.dev>
Date:   Mon Nov 2 17:08:31 2026 -0800

    Avoid a possible out-of-bounds write after inflateReset().

    If inflate() was asked to get the window size from the zlib header,
    and that size was invalid, inflateReset() or inflateSync() would
    retain it, and a subsequent inflateGetDictionary() could write past
    a user-supplied 32K buffer.

    Reported by Theorem (THM-ZLIB-001).

diff --git a/inflate.c b/inflate.c
index f3ac3f9..1aed584 100644
--- a/inflate.c
+++ b/inflate.c
@@ -545,13 +545,13 @@ int ZEXPORT inflate(z_streamp strm, int flush) {
             }
             DROPBITS(4);
             len = BITS(4) + 8;
-            if (state->wbits == 0)
-                state->wbits = len;
-            if (len > 15 || len > state->wbits) {
+            if (len > 15 || (state->wbits != 0 && len > state->wbits)) {
                 strm->msg = (z_const char *)"invalid window size";
                 state->mode = BAD;
                 break;
             }
+            if (state->wbits == 0)
+                state->wbits = len;
             state->dmax = 1U << len;
             state->flags = 0;               /* indicate zlib header */
             Tracev((stderr, "inflate:   zlib header ok\n"));