projects / openwrt / staging / stintel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 98df6bd) | patch
zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)
authorPetr Štetiar <ynezz@true.cz>
Sat, 6 Aug 2022 12:55:07 +0000 (14:55 +0200)
committerPetr Štetiar <ynezz@true.cz>
Sat, 6 Aug 2022 13:00:08 +0000 (15:00 +0200)
commit7df6795d4c25447683fd4b4a4813bebcddaea547
treeaa4d160e103d1dc5355a569525f2ec54e1bf6bdctree | snapshot
parent98df6bd99c0f70d4f2ad709af09084f985689ff5commit | diff
zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow
in inflate in inflate.c via a large gzip header extra field. NOTE: only
applications that call inflateGetHeader are affected. Some common
applications bundle the affected zlib source code but may be unable to
call inflateGetHeader.

Fixes: CVE-2022-37434
References: https://github.com/ivd38/zlib_overflow
Signed-off-by: Petr Štetiar <ynezz@true.cz>
package/libs/zlib/patches/006-fix-CVE-2022-37434.patch [new file with mode: 0644] blob
Staging tree of Stijn Tintel