Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 5 Dec 2016 08:15:09 +0100
From: Marcus Meissner <>
To: OSS Security List <>,
Subject: CVE Request: zlib security issues found during audit


Mozilla has asked Trail of Bits / TrustInSoft to audit zlib

which had some findings (1 medium, 4 low):

extracting from the referenced document:

zlib SOS Fund Audit Fix Log
Identified Issues

Finding 1: Incompatible declarations for external linkage function deflate (Medium)

Finding 2: Accessing a buffer of char via a pointer to unsigned int (Low)
Mark Adler (zlib): [This] will remain as is. Yes, speed matters a great deal. The comment in
the report: "In the longer term, platform specific micro-optimizations should be deprecated.
These optimizations may no longer be necessary: modern compilers are much better at
optimizing and vectorizing code than they used to be." does not apply. This is not a
micro-optimization, and unless the compiler has the intelligence and creativity of a good
mathematician well-versed in discrete mathematics, can detect the application of Galois
Fields in the code, know somehow to postulate a theorem for an equivalent calculation over
GF(2) that will, in the end, improve the speed, prove that theorem, and then generate on its
own the additional tables to apply that theorem, then no, there is no way that a compiler is
coming up with that one.
UNRESOLVED:This issue remains under discussion to determine whether there is a way
which removes the mismatched pointer without affecting performance.

Finding 3: Out-of-bounds pointer arithmetic in inftrees.c (Low)

Finding 4: Undefined left shift of negative number (Low)
(This was already fixed on the development branch before being discovered.)

Finding 5: Big-endian out-of-bounds pointer (Low)

Ciao, Marcus

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.