Fix: Potential Vulnerability in Cloned zlib-Function#6245
Fix: Potential Vulnerability in Cloned zlib-Function#6245mvieth merged 1 commit intoPointCloudLibrary:masterfrom
Conversation
inftrees.c was subtracting an offset from a pointer to an array, in order to provide a pointer that allowed indexing starting at the offset. This is not compliant with the C standard, for which the behavior of a pointer decremented before its allocated memory is undefined. Per the recommendation of a security audit of the zlib code by Trail of Bits and TrustInSoft, in support of the Mozilla Foundation, this tiny optimization was removed, in order to avoid the possibility of undefined behavior.
mvieth
added
module: surface
changelog: fix
|
Hi @mvieth, thanks for merging my PR. Just want to let you know that I plan to report this as a CVE. Let me know if you have any concern! |
Thanks for the heads-up. Same suggestion as in #6246 (comment) :
|
mvieth
changed the title
2 participants
Description
This PR fixes a security vulnerability in inflate_table() that was cloned from zlib but did not receive the security patch. The original issue was reported and fixed under madler/zlib@6a04314.
This PR applies the same patch to eliminate the vulnerability.
References
https://nvd.nist.gov/vuln/detail/CVE-2016-9840
madler/zlib@6a04314