Red Hat Bugzilla – Bug 84961
buffer overrun on gzprintf
Last modified: 2007-04-18 12:51:34 EDT
From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; T312461; .NET
Description of problem:
when the function gzprintf is called with a string bigger than Z_PRINTF_BUFZISE
it overflows without giving a warning.
it defaults to the unsafe functions unless instructed at compile time to use
the secure ones that won't overflow, no warning is given of an error on those
Version-Release number of selected component (if applicable): ALL
Steps to Reproduce:
1. compile code on URL
Actual Results: execution error
Expected Results: non fatal errors returned from the gzprintf call
Additional info: this error is also present on the current rawhide version of
zlib and in the older releases
Created attachment 90308 [details]
zlib 1.1.4 patch that test for [v]snprintf support and fixes overflow
Announcement of this issue is here:
FIxed in zli8b-1.1.4-8.
the Rawhide package was also affected, but this bug was introduced on zlib on
1.0.6 (Jan 19, 1998), and therefore all of the currently suported releases are
i would recommend an errata for zlib and the packages that use it statically
even if the rawhide release (couldn't test it though as it is not yet
available) is fixed, the zlib package i reported with the problem (the one on
RH 7.3) needs still a fix that only an errata and not a rawhide package could
A preliminary audit shows only
actually using gzprintf. That's hardly enough
to justify an errata, but that's not my call.
An errata will be issued if the risk is deemed
sufficiently high. Meanwhile, the patch is applied in
An errata has been issued which should help the problem described in this bug report.
This report is therefore being closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, please follow the link below. You may reopen
this bug report if the solution does not work for you.