Heap-based Buffer Overflow Affecting zlib package, versions [,1.3.2)

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the gzvprintf and gzprintf functions in gzwrite.c, where the fallback path selected by the NO_vsnprintf and NO_snprintf macros formats into the internal state->in buffer with vsprintf or sprintf and performs no length enforcement against state->size. An attacker who controls the format string or the arguments passed to gzprintf can write past the end of the heap allocation and corrupt adjacent memory and chunk metadata, since the physical allocation is only state->want << 1. This requires the library to have been built in the legacy configuration that defines those macros, which is reached only on platforms without C99 snprintf.

Note: This cannot be triggered by compressed input alone. gzprintf is write-side, and nothing on the inflate path calls it.

Note: This is a bypass of the fix for the vulnerability described in CVE-2003-0107, and described as a known limitation to avoid in https://zlib.net/zlib_faq.html#faq33.

• 7asecurity Report
• GitHub Commit
• GitHub Release