Use of Uninitialized Resource Affecting madler/zlib package, versions [,1.3.2)

Affected versions of this package are vulnerable to Use of Uninitialized Resource in the inflateCopy function in inflate.c, which allocates a destination sliding window and then zmemcpys the full wsize from the source window without regard to whave, the counter tracking how much of that window holds valid data. An attacker able to read the destination stream state, through a process memory dump, a serialization or logging interface, or a separate arbitrary read, can recover residual heap contents from earlier allocations, because zcalloc is backed by malloc rather than calloc and leaves the region between whave and wsize uninitialized. This requires the source stream to have not yet filled its window and an application that both calls inflateCopy and exposes the copied state.

Note: This cannot be triggered by compressed input alone. inflateCopy has no callers inside the library, and the propagated bytes stay in zlib-internal buffers that no API returns.

• 7asecurity Report
• GitHub Commit
• GitHub Commit
• GitHub Release