Commit c042415 for zlib
commit c042415934a0487e87e17f4b634e079d17f7aaf8
Author: ronald.eytchison@trailofbits.com <ronald.eytchison@trailofbits.com>
Date: Fri Jun 5 19:10:16 2026 +0000
Restore requested inflate window on reset.
inflateReset() did not restore a windowBits request of 0 or 32, so
a reused stream would keep the window size from the previous
stream's header, and a later stream needing a larger window would
be rejected.
Reported by Trail of Bits (TOB-ZLIB-007).
diff --git a/inflate.c b/inflate.c
index 09a7883..95bed57 100644
--- a/inflate.c
+++ b/inflate.c
@@ -127,6 +127,13 @@ int ZEXPORT inflateReset(z_streamp strm) {
if (inflateStateCheck(strm)) return Z_STREAM_ERROR;
state = (struct inflate_state FAR *)strm->state;
+ if (state->wbits != state->reqbits) {
+ if (state->window != Z_NULL) {
+ ZFREE(strm, state->window);
+ state->window = Z_NULL;
+ }
+ state->wbits = state->reqbits;
+ }
state->wsize = 0;
state->whave = 0;
state->wnext = 0;
@@ -166,7 +173,7 @@ int ZEXPORT inflateReset2(z_streamp strm, int windowBits) {
/* update state and reset the rest of it */
state->wrap = wrap;
- state->wbits = (unsigned)windowBits;
+ state->reqbits = state->wbits = (unsigned)windowBits;
return inflateReset(strm);
}
diff --git a/inflate.h b/inflate.h
index f758e0d..7fde4d1 100644
--- a/inflate.h
+++ b/inflate.h
@@ -93,7 +93,8 @@ struct inflate_state {
unsigned long total; /* protected copy of output count */
gz_headerp head; /* where to save gzip header information */
/* sliding window */
- unsigned wbits; /* log base 2 of requested window size */
+ unsigned reqbits; /* requested log base 2 of window size */
+ unsigned wbits; /* current log base 2 of window size */
unsigned wsize; /* window size or zero if not using window */
unsigned whave; /* valid bytes in the window */
unsigned wnext; /* window write index */