Skip to content

Fix potential vulnerable cloned function #3072

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

npt-1707
Copy link

Description

I identified a potential vulnerability in clone functions in deflate.c and tree.c in abc/src/misc/zlib sourced from madler/zlib. This issue, originally reported in CVE-2018-25032, was resolved in the repository via this commit madler/zlib@5c44459.

Related Issue

None

Motivation and Context

My PR aims to bring a potential vulnerable clone function into your attention. I've applied the corresponding patch to fix the vulnerability in this codebase. Please review at your convenience.

How Has This Been Tested?

TODO: run test suite

Types of changes

  • [x ] Bug fix (change which fixes an issue)
  • New feature (change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

  • My change requires a change to the documentation
  • I have updated the documentation accordingly
  • I have added tests to cover my changes
  • All new and existing tests passed

@npt-1707 npt-1707 changed the title Fix a bug that can crash deflate on some input when using Z_FIXED. Fix potential vulnerable cloned function May 21, 2025
@github-actions github-actions bot added ABC ABC Logic Optimization & Technology Mapping Tool lang-cpp C/C++ code labels May 21, 2025
@AlexandreSinger
Copy link
Contributor

Hi @npt-1707 , VTR is not the "home" repository of ABC. VTR copies ABC into it using a subtree, which makes the code look like it lives here.

Any changes to ABC should be made to the base ABC repository here: https://github.com/berkeley-abc/abc

I recommend you raise this PR on that repo.

After it is merged into master, if the change is needed on VTR, we can update the subtree of ABC on VTR to point to a more up to date version of ABC.

@vaughnbetz Correct me if anything I said above is incorrect.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ABC ABC Logic Optimization & Technology Mapping Tool lang-cpp C/C++ code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants