zlib

zlib Audit Findings

Security audit of the zlib compression library and its bundled ports. Each finding includes a detailed write-up and a patch.

Summary

Total findings: 18 -- High: 8, Medium: 10, Low: 0

Findings

minizip / zip extraction

#	Finding	Severity
004	Global comment API NULL buffer dereference	Medium
007	Archive paths can escape extraction directory	High
028	Repaired archive can claim omitted oversized entry data	Medium

Zip64 / extra fields

#	Finding	Severity
003	ZIP64 extra field parser overreads declared subfield	High
009	Extra-field parser trusts attacker-controlled lengths	High

ZIP encryption

#	Finding	Severity
021	ZIP encryption relies on legacy PKWARE cipher	High
022	Encrypted header leaks CRC bytes for offline password checks	Medium

gzip stream / trailer

#	Finding	Severity
011	Trailer CRC validation missing in joined members	Medium
020	Insecure vsprintf fallback overflows gzprintf buffer	High

iostream2 stream parsing

#	Finding	Severity
005	Unchecked length-prefixed read overflows caller buffer	High
006	Failed length read can use uninitialized size_t value	High

Locking and file handling

#	Finding	Severity
001	Lock ownership check can delete another process's lock	Medium
023	Negative file length drives unchecked allocation size	Medium
024	Short filename suffix check reads before argument buffer	High

Symlink and path traversal

#	Finding	Severity
002	User-controlled sidecar path allows symlink clobbering	Medium

Concurrency

#	Finding	Severity
019	Fixed Huffman table initialization races across threads	Medium
026	Unsynchronized lazy Huffman table initialization in blast	Medium

DLL / Windows loading

#	Finding	Severity
015	Unqualified ZLIB1.dll import crosses library-loading trust boundary	Medium