Closed cyruscyliu closed 8 months ago
As expected, zError(errno) shall return NULL if errno is not a valid error code. However, there is no check in the current implementation.
https://github.com/madler/zlib/blob/643e17b7498d12ab8d15565662880579692f769d/zutil.c#L131 https://github.com/madler/zlib/blob/643e17b7498d12ab8d15565662880579692f769d/zutil.c#L132 https://github.com/madler/zlib/blob/643e17b7498d12ab8d15565662880579692f769d/zutil.h#L59
A misuse could leak information as zError() might return a manually crafted pointer.
Could you please comment or fix it?
Thank you for the report. Though zError() is an undocumented function, and so not part of the zlib application interface, I have nevertheless added a bounds check for it.
zError()
As expected, zError(errno) shall return NULL if errno is not a valid error code. However, there is no check in the current implementation.
https://github.com/madler/zlib/blob/643e17b7498d12ab8d15565662880579692f769d/zutil.c#L131 https://github.com/madler/zlib/blob/643e17b7498d12ab8d15565662880579692f769d/zutil.c#L132 https://github.com/madler/zlib/blob/643e17b7498d12ab8d15565662880579692f769d/zutil.h#L59
A misuse could leak information as zError() might return a manually crafted pointer.
Could you please comment or fix it?