Added unit test for CVE-2018-25032#1208
Merged
Dead2 merged 4 commits intozlib-ng:developfrom Apr 3, 2022
Merged
Conversation
9477e12 to
1bb67e3
Compare
Codecov Report
@@ Coverage Diff @@
## develop #1208 +/- ##
===========================================
+ Coverage 87.95% 88.04% +0.08%
===========================================
Files 114 114
Lines 10147 10194 +47
Branches 2539 2551 +12
===========================================
+ Hits 8925 8975 +50
+ Misses 971 969 -2
+ Partials 251 250 -1
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report at Codecov.
|
1bb67e3 to
2da0ba0
Compare
Member
Author
|
I want to add the new test case they came up with |
Sample input from https://www.openwall.com/lists/oss-security/2022/03/26/1. Co-authored-by: Tavis Ormandy <taviso@users.noreply.github.com>
2da0ba0 to
f1bb219
Compare
Member
Author
|
Rebased. |
Co-authored-by: Eric Biggers <ebiggers@kernel.org>
Member
Author
|
Added the new test case against |
Member
|
I think we should test this on both level 1 and level 2 as well, since as far as I have understood this problem, it is basically a buffer overrun situation when using low compression. Both deflate_quick (level 1) and deflate_fast (level 2) should thus probably get tested separately. Especially since our level 2 is essentially zlibs level 1 (with modifications of course, such as 4-byte matches instead of 3-byte, thus possibly making this problem more likely). |
Member
Author
|
@Dead2 I have added those test levels. |
Dead2
approved these changes
Apr 2, 2022
Merged
Dead2
added a commit
that referenced
this pull request
Mar 7, 2023
Changes since 2.0.6: - Fix CVE-2022-37434 #1328 - Fix chunkmemset #1196 - Fix deflateBound too small #1236 - Fix Z_SOLO #1263 - Fix ACLE variant of crc32 #1274 - Fix inflateBack #1311 - Fix deflate_quick windowsize #1431 - Fix DFLTCC bugs related to adler32 #1349 and #1390 - Fix warnings #1194 #1312 #1362 - MacOS build fix #1198 - Add invalid windowBits handling #1293 - Support for Force TZCNT #1186 - Support for aligned_alloc() #1360 - Minideflate improvements #1175 #1238 - Dont use unaligned access for memcpy #1309 - Build system #1209 #1233 #1267 #1273 #1278 #1292 #1316 #1318 #1365 - Test improvements #1208 #1227 #1241 #1353 - Cleanup #1266 - Documentation #1205 #1359 - Misc improvements #1294 #1297 #1306 #1344 #1348 - Backported zlib fixes - Backported CI workflows from Develop branch
Dead2
added a commit
that referenced
this pull request
Mar 17, 2023
Changes since 2.0.6: - Fix CVE-2022-37434 #1328 - Fix chunkmemset #1196 - Fix deflateBound too small #1236 - Fix Z_SOLO #1263 - Fix ACLE variant of crc32 #1274 - Fix inflateBack #1311 - Fix deflate_quick windowsize #1431 - Fix DFLTCC bugs related to adler32 #1349 and #1390 - Fix warnings #1194 #1312 #1362 - MacOS build fix #1198 - Add invalid windowBits handling #1293 - Support for Force TZCNT #1186 - Support for aligned_alloc() #1360 - Minideflate improvements #1175 #1238 - Dont use unaligned access for memcpy #1309 - Build system #1209 #1233 #1267 #1273 #1278 #1292 #1316 #1318 #1365 - Test improvements #1208 #1227 #1241 #1353 - Cleanup #1266 - Documentation #1205 #1359 - Misc improvements #1294 #1297 #1306 #1344 #1348 - Backported zlib fixes - Backported CI workflows from Develop branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See madler/zlib#605 for background.
Using minideflate compiled against zlib
masterfails the test.Using minideflate compiled against the zlib-ng passes the test.