Skip to content

Panic in deflateParams due to corrupted z_stream.state #510

@JokerSerge

Description

@JokerSerge

The safety contract of deflateParams requires that the provided z_stream is valid and has been properly initialized (e.g., via deflateInit2_). However, it does not explicitly state that the internal state pointed to by z_stream.state should remain unmodified after initialization. This omission allows external mutation of the state to violate internal invariants.

This can be demonstrated with the following example, which leads to a panic in deflateParams:

use libz_rs_sys::*;

fn main() {
    unsafe {
        let mut strm: z_stream = std::mem::zeroed();

        deflateInit2_(
            &mut strm,
            6, 8, 15, 8, 0,
            zlibVersion(),
            std::mem::size_of::<z_stream>() as i32,
        );

        // corrupt internal state
        let p = strm.state as *mut u8;
        p.add(4).write(100);

        // panic
        let _ = deflateParams(&mut strm, 1, 0);
    }
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions