Repository navigation
deps: update zlib to 1.3.0.1-motley-24342f6 - #52123
Merged
Merged
Conversation
nodejs-github-bot
added
the
dependencies
Collaborator
Author
|
Review requested:
|
nodejs-github-bot
added
needs-ci
lpinca
approved these changes
Mar 17, 2024
lpinca
added
the
request-ci
github-actions
Bot
removed
the
request-ci
Collaborator
Author
marco-ippolito
approved these changes
Mar 17, 2024
Collaborator
Author
mhdawson
approved these changes
Mar 18, 2024
mhdawson
left a comment
mhdawson
left a comment
Member
There was a problem hiding this comment.
RSLGTM based on automation generating PR
Collaborator
Author
marco-ippolito
added
author ready
nodejs-github-bot
removed
the
commit-queue
Collaborator
Author
|
Landed in 70a0510 |
marco-ippolito
pushed a commit
that referenced
this pull request
May 2, 2024
PR-URL: #52123 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Michael Dawson <midawson@redhat.com>
Merged
marco-ippolito
pushed a commit
that referenced
this pull request
May 3, 2024
PR-URL: #52123 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Michael Dawson <midawson@redhat.com>
richardlau
pushed a commit
that referenced
this pull request
May 16, 2024
PR-URL: #52123 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Michael Dawson <midawson@redhat.com>
Merged
ptweezy
added a commit
to ptweezy/node
that referenced
this pull request
Oct 30, 2026
The memory corruption that led to disabling CRC32_SIMD_SSE42_PCLMUL came from crc_fold_copy() in deps/zlib/crc_folding.c. For the final (len % 16) bytes of a copy it did a 16-byte unaligned store, writing up to 15 bytes past the destination. With gzip at level 0, deflate_stored() copies input straight into strm->next_out through read_buf() and copy_with_crc(), so the overrun landed past the end of the caller's output buffer and corrupted the heap. Chromium replaced that store with zmemcpy(), and the fix arrived here with the zlib update in 70a0510 (v22.0.0). With the old code, the added test aborts v19.0.0 and v20.6.0 builds every time. With the current code it passes, and the CRC32 SIMD path is clean under ASan. The restored zlib_crc32_simd target predates clang-cl support on Windows, so also pass -msse4.2 and -mpclmul through msvs_settings, as zlib_adler32_simd does. The bundled zlib only detects CPU features in deflateInit2() and when crc32() or adler32() is called with a NULL buffer. zlib.crc32() always passes a buffer, so it used the portable code until a stream had triggered the detection. Trigger it when the binding is initialized so zlib.crc32() uses the SIMD path from the start. Fixes: nodejs#45268 Refs: nodejs#49511 Refs: nodejs#52123 Assisted-by: Claude Code Signed-off-by: Parker Loflin <parker@cronstable.dev>
ptweezy
added a commit
to ptweezy/node
that referenced
this pull request
Oct 30, 2026
The memory corruption that led to disabling CRC32_SIMD_SSE42_PCLMUL came from crc_fold_copy() in deps/zlib/crc_folding.c. For the final (len % 16) bytes of a copy it did a 16-byte unaligned store, writing up to 15 bytes past the destination. With gzip at level 0, deflate_stored() copies input straight into strm->next_out through read_buf() and copy_with_crc(), so the overrun landed past the end of the caller's output buffer and corrupted the heap. Chromium replaced that store with zmemcpy(), and the fix arrived here with the zlib update in 70a0510 (v22.0.0). With the old code, the added test aborts v19.0.0 and v20.6.0 builds every time. With the current code it passes, and the CRC32 SIMD path is clean under ASan and valgrind. The restored zlib_crc32_simd target predates clang-cl support on Windows, so also pass -msse4.2 and -mpclmul through msvs_settings, as zlib_adler32_simd does. The bundled zlib only detects CPU features in deflateInit2() and when crc32() or adler32() is called with a NULL buffer. zlib.crc32() always passes a buffer, so it used the portable code until a stream had triggered the detection. Trigger it when the binding is initialized so zlib.crc32() uses the SIMD path from the start. Refs: nodejs#45268 Refs: nodejs#49511 Refs: nodejs#52123 Assisted-by: Claude Code Signed-off-by: Parker Loflin <parker@cronstable.dev>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is an automated update of zlib to 1.3.0.1-motley-24342f6.