Skip to content

Update zlib to the 1.2.10 release #5031

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jan 19, 2017
Merged

Conversation

ibuclaw
Copy link
Member

@ibuclaw ibuclaw commented Jan 13, 2017

These are the changes updating zlib from 1.2.8 to 1.2.10. The new release includes fixes for security
issues CVE-2016-9840, CVE-2016-9841, CVE-2016-9842, CVE-2016-9843.

http://seclists.org/oss-sec/2016/q4/602

Apart from below changelog, I also sync'd up the documentation between zlib.h and zlib.d. There were also some missing functions.

  • deflatePending (added in 1.2.5.3)
  • inflateGetDictionary (added in 1.2.7.1)
  • inflateMark/inflateReset2 (added in 1.2.3.4)
  • gzbuffer/gzoffset/gzclose_r/gzclose_w (added in 1.2.3.5)

Changes in 1.2.10 (2 Jan 2017)

  • Avoid warnings on snprintf() return value
  • Fix bug in deflate_stored() for zero-length input
  • Fix bug in gzwrite.c that produced corrupt gzip files
  • Remove files to be installed before copying them in Makefile.in
  • Add warnings when compiling with assembler code

Changes in 1.2.9 (31 Dec 2016)

  • Fix contrib/minizip to permit unzipping with desktop API [Zouzou]
  • Improve contrib/blast to return unused bytes
  • Assure that gzoffset() is correct when appending
  • Improve compress() and uncompress() to support large lengths
  • Fix bug in test/example.c where error code not saved
  • Remedy Coverity warning [Randers-Pehrson]
  • Improve speed of gzprintf() in transparent mode
  • Fix inflateInit2() bug when windowBits is 16 or 32
  • Change DEBUG macro to ZLIB_DEBUG
  • Avoid uninitialized access by gzclose_w()
  • Allow building zlib outside of the source directory
  • Fix bug that accepted invalid zlib header when windowBits is zero
  • Fix gzseek() problem on MinGW due to buggy _lseeki64 there
  • Loop on write() calls in gzwrite.c in case of non-blocking I/O
  • Add --warn (-w) option to ./configure for more compiler warnings
  • Reject a window size of 256 bytes if not using the zlib wrapper
  • Fix bug when level 0 used with Z_HUFFMAN or Z_RLE
  • Add --debug (-d) option to ./configure to define ZLIB_DEBUG
  • Fix bugs in creating a very large gzip header
  • Add uncompress2() function, which returns the input size used
  • Assure that deflateParams() will not switch functions mid-block
  • Dramatically speed up deflation for level 0 (storing)
  • Add gzfread(), duplicating the interface of fread()
  • Add gzfwrite(), duplicating the interface of fwrite()
  • Add deflateGetDictionary() function
  • Use snprintf() for later versions of Microsoft C
  • Fix *Init macros to use z_ prefix when requested
  • Replace as400 with os400 for OS/400 support [Monnerat]
  • Add crc32_z() and adler32_z() functions with size_t lengths
  • Update Visual Studio project files [AraHaan]

@ibuclaw ibuclaw force-pushed the zlib1_2_10 branch 3 times, most recently from b1470e1 to 1a2eebf Compare January 13, 2017 07:48
{
uLong adler = adler32(0L, Z_NULL, 0);

while (read_buffer(buffer, length) != EOF) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm CircleCi doesn't like this because it tries to enforce the Allman style over the entire codebase. Is this entire file is automatically generated? Then we could exclude etc.c.zlib

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No it's not automatically generated, which is why there were a number of missing functions. :-)

I am surprised that it's complaining about a comment, though...

Changes in 1.2.10 (2 Jan 2017)
- Avoid warnings on snprintf() return value
- Fix bug in deflate_stored() for zero-length input
- Fix bug in gzwrite.c that produced corrupt gzip files
- Remove files to be installed before copying them in Makefile.in
- Add warnings when compiling with assembler code

Changes in 1.2.9 (31 Dec 2016)
- Fix contrib/minizip to permit unzipping with desktop API [Zouzou]
- Improve contrib/blast to return unused bytes
- Assure that gzoffset() is correct when appending
- Improve compress() and uncompress() to support large lengths
- Fix bug in test/example.c where error code not saved
- Remedy Coverity warning [Randers-Pehrson]
- Improve speed of gzprintf() in transparent mode
- Fix inflateInit2() bug when windowBits is 16 or 32
- Change DEBUG macro to ZLIB_DEBUG
- Avoid uninitialized access by gzclose_w()
- Allow building zlib outside of the source directory
- Fix bug that accepted invalid zlib header when windowBits is zero
- Fix gzseek() problem on MinGW due to buggy _lseeki64 there
- Loop on write() calls in gzwrite.c in case of non-blocking I/O
- Add --warn (-w) option to ./configure for more compiler warnings
- Reject a window size of 256 bytes if not using the zlib wrapper
- Fix bug when level 0 used with Z_HUFFMAN or Z_RLE
- Add --debug (-d) option to ./configure to define ZLIB_DEBUG
- Fix bugs in creating a very large gzip header
- Add uncompress2() function, which returns the input size used
- Assure that deflateParams() will not switch functions mid-block
- Dramatically speed up deflation for level 0 (storing)
- Add gzfread(), duplicating the interface of fread()
- Add gzfwrite(), duplicating the interface of fwrite()
- Add deflateGetDictionary() function
- Use snprintf() for later versions of Microsoft C
- Fix *Init macros to use z_ prefix when requested
- Replace as400 with os400 for OS/400 support [Monnerat]
- Add crc32_z() and adler32_z() functions with size_t lengths
- Update Visual Studio project files [AraHaan]
@ibuclaw
Copy link
Member Author

ibuclaw commented Jan 15, 2017

Removed braces from documentation - looks like all passes, so will welcome any further testing.

@JackStouffer
Copy link
Member

Not really sure who's qualified to review this :/

I'd rather not have this end up like your other PR's which sit unreviewed because they're too complex for most reviewers.

@ibuclaw
Copy link
Member Author

ibuclaw commented Jan 19, 2017

I'd rather not have this end up like your other PR's which sit unreviewed because they're too complex for most reviewers

Too complex? This is just updating C sources from the zlib and syncing up the C bindings. ;-)

Infact can you point me in the direction of one of the PR's that are just sitting there? Maybe I should close them and open a new issue describing the problem and attempted fix.

@JackStouffer
Copy link
Member

Infact can you point me in the direction of one of the PR's that are just sitting there?

#4272 and #3310

@JackStouffer
Copy link
Member

Too complex? This is just updating C sources from the zlib and syncing up the C bindings. ;-)

If this really is just a copy/pasta then I see no issue relying on the auto-tester.

@dlang-bot dlang-bot merged commit 35ade48 into dlang:master Jan 19, 2017
@ibuclaw
Copy link
Member Author

ibuclaw commented Jan 20, 2017

Thanks.

@ibuclaw ibuclaw deleted the zlib1_2_10 branch January 20, 2017 07:47
@ibuclaw
Copy link
Member Author

ibuclaw commented Jan 23, 2017

Rats, they've gone and released 1.2.11 in the meantime.

Maybe we should revert until a time when they've stabilized? Otherwise I'll merge the new changes in...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants