Commit 8179479 for zlib

commit 8179479c6274c0041189882b8746a33e2376eaf0
Author: Mark Adler <git@madler.net>
Date:   Mon Oct 26 14:14:33 2026 -0700

    Use the maximum window size after inflateSync() if not yet known.

    With windowBits 0, inflate() learns the window size from the zlib
    or gzip header. If inflateSync() recovered before any header was
    processed, decoding continued with a window size of zero, which
    allocated a one-byte window. Back-references longer than the output
    buffer then failed with "invalid distance too far back", and if the
    stream was reused, a header that set the window size would make
    updatewindow() write past that one-byte allocation.

    Reported by Trail of Bits (TOB-ZLIB-004).

diff --git a/inflate.c b/inflate.c
index b9c3949..09a7883 100644
--- a/inflate.c
+++ b/inflate.c
@@ -1306,6 +1306,14 @@ int ZEXPORT inflateSync(z_streamp strm) {
     inflateReset(strm);
     strm->total_in = in;  strm->total_out = out;
     state->flags = flags;
+    if (state->wbits == 0) {
+        /* we never got to see a header for the window size -- set to max */
+        if (state->window != Z_NULL) {
+            ZFREE(strm, state->window);
+            state->window = Z_NULL;
+        }
+        state->wbits = 15;
+    }
     state->mode = TYPE;
     return Z_OK;
 }