Hide Forgot
The declaration and implementation of the deflate function use incompatible types. The first argument to deflate is of type zstreamp, which is a pointer to an internal structure that has a member of type struct internal_state. In a default compilation of zlib, struct internal_state is re-defined after the declaration of deflate . External References: https://wiki.mozilla.org/images/0/09/Zlib-report.pdf https://docs.google.com/document/d/10i1KZS5so8xDqH2rplRa2xet0tyTvvJlLbQQmZIUIKE/edit#heading=h.t13tvnx4loq7 Upstream patch: https://github.com/madler/zlib/commit/3fb251b363866417122fe54a158a1ac5a7837101
My bad, this one did not receive a CVE. We feel that the scope of CVE should, ideally, omit unexploitable code-quality issues. The PDF report has a number of comments about Finding 1; however, one comment is "current compilers process this code without issues." A finding can be important to the practice of software development without being important for vulnerability management. For now, the answer is that there is no CVE ID.