Skip to content

Reject a null dictionary in inflateSetDictionary(). - #1305

Open
samuelgirmametaferia wants to merge 1 commit into
madler:developfrom
samuelgirmametaferia:fix/inflate-null-dictionary
Open

Reject a null dictionary in inflateSetDictionary().#1305
samuelgirmametaferia wants to merge 1 commit into
madler:developfrom
samuelgirmametaferia:fix/inflate-null-dictionary

Conversation

@samuelgirmametaferia

Copy link
Copy Markdown

Summary

Reject a null dictionary in inflateSetDictionary() before raw-inflate dictionary handling reaches updatewindow().

The API documentation already specifies that a null dictionary is an invalid parameter and should return Z_STREAM_ERROR. The zlib-wrapper path happens to reject it because the stream is not in DICT, but raw inflate permits dictionaries at any time. In that mode, a nonzero dictLength with dictionary == Z_NULL reaches updatewindow() and passes a null source to the window copy, causing a crash.

deflateSetDictionary() already validates the same pointer. This change makes the inflate side match the documented contract and adds coverage for the raw-inflate case.

Validation

  • pristine origin/develop: inflateSetDictionary(&strm, Z_NULL, 1) after inflateInit2(&strm, -15) triggers UBSan and then an ASan null-read in updatewindow()
  • patched focused call: returns Z_STREAM_ERROR (-2)
  • CMake build: pass
  • CTest: 15/15 tests pass, including infcover
  • git diff --check: pass

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant