1795709 - Update comm/third_party/zlib to 1.2.13

Status: RESOLVED FIXED

(Thunderbird :: Build Config, task)

Description

[Rob Lemley [:rjl]]

Version 1.2.13 has these key updates from 1.2.12:

• Fix a bug when getting a gzip header extra field with inflateGetHeader(). This remedies CVE-2022-37434.
• Fix a bug in block type selection when Z_FIXED used. Now the smallest block type is selected, for better compression.
• Fix a configure issue that discarded the provided CC definition.
• Correct incorrect inputs provided to the CRC functions. This mitigates a bug in Java.
• Repair prototypes and exporting of the new CRC functions.
• Fix inflateBack to detect invalid input with distances too far.

Due to the first bug fix, any installations of 1.2.12 or earlier should be replaced with 1.2.13.

Thunderbird's use of zlib in librnp appears unaffected; should update nevertheless.

Comment 1

[Rob Lemley [:rjl]]

Attachment: Bug 1795709 - Use mach vendor to update zlib sources. r=#thunderbird-reviewers

moz.yaml drives mach vendor, it requires a LICENSE file (grabbed from zlib
v1.2.13). Updated README.zlib so mach vendor can update it. Removing zlib.def
as it's not needed.

Comment 2

[Rob Lemley [:rjl]]

Attachment: Bug 1795709 - Update zlib source to v1.2.13. r=#thunderbird-reviewers

Result of running:
../mach vendor -r v1.2.13 third_party/zlib/moz.yaml

Depends on D159550

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/a985e381040d
Use mach vendor to update zlib sources. r=mkmelin
https://hg.mozilla.org/comm-central/rev/a1a50418d546
Update zlib source to v1.2.13. r=mkmelin

Comment 4

[Rob Lemley [:rjl]]

Comment on attachment 9298927 [details]
Bug 1795709 - Use mach vendor to update zlib sources. r=#thunderbird-reviewers

[Triage Comment]
Approved for beta as this should go on c-esr102 in 102.5.0. Note to uplifter: 2 patches to uplift

[Approval Request Comment]
Regression caused by (bug #): N/A
User impact if declined: its an internal library used by librnp. little impact to zero
Testing completed (on c-c, etc.): Daily
Risk to taking this patch (and alternatives if risky): The zlib change itself will have little to no risk. The mach vendor piece may not work so well on c-esr102, but that's for for users anyway and should only run on c-central.

Comment 5

[Daniel Darnell [:dandarnell]]

Thunderbird 107.0b4:
https://hg.mozilla.org/releases/comm-beta/rev/a35709037d8d

Comment 6

[Daniel Darnell [:dandarnell]]

Thunderbird 107.0b4:
https://hg.mozilla.org/releases/comm-beta/rev/c01564d54aac

Comment 7

[Wayne Mery (:wsmwk)]

Comment on attachment 9298927 [details]
Bug 1795709 - Use mach vendor to update zlib sources. r=#thunderbird-reviewers

[Triage Comment]
Approved for esr102

Comment 8

[Wayne Mery (:wsmwk)]

Comment on attachment 9298928 [details]
Bug 1795709 - Update zlib source to v1.2.13. r=#thunderbird-reviewers

[Triage Comment]
Approved for esr102

Comment 9

[Rob Lemley [:rjl]]

Thunderbird 102.5.0:
https://hg.mozilla.org/releases/comm-esr102/rev/beafc1874fee
https://hg.mozilla.org/releases/comm-esr102/rev/0e2d5ff3e8e9