Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Comments

Potential Vulnerability in Cloned Code#625

Open
tabudz wants to merge 1 commit intoemsec:master from
tabudz:CVE-2016-9841
Open

Potential Vulnerability in Cloned Code #625
tabudz wants to merge 1 commit intoemsec:master from
tabudz:CVE-2016-9841

Conversation

@tabudz
Copy link

@tabudz tabudz commented Nov 24, 2025

Summary

Our tool detected a potential vulnerability in deps/abc/src/misc/zlib/inffast.c which was cloned from madler/zlib but did not receive the security patch applied in madler/zlib. The original issue was reported and fixed under https://nvd.nist.gov/vuln/detail/cve-2016-9841.

Proposed Fix

Apply the same patch as the one in madler/zlib to eliminate the vulnerability.

Reference

https://nvd.nist.gov/vuln/detail/cve-2016-9841
madler/zlib@9aaec95

An old inffast.c optimization turns out to not be optimal anymore
with modern compilers, and furthermore was not compliant with the
C standard, for which decrementing a pointer before its allocated
memory is undefined. Per the recommendation of a security audit of
the zlib code by Trail of Bits and TrustInSoft, in support of the
Mozilla Foundation, this "optimization" was removed, in order to
avoid the possibility of undefined behavior.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nils1603 nils1603 Awaiting requested review from nils1603 nils1603 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

AltStyle によって変換されたページ (->オリジナル) /