1796811 - Update zlib to version 1.2.13

Status: RESOLVED FIXED

(Core :: General, task)

Description

[Ryan VanderMeulen [:RyanVM]]

Version 1.2.13 has these key updates from 1.2.12:

• Fix a bug when getting a gzip header extra field with inflateGetHeader(). This remedies CVE-2022-37434.
• Fix a bug in block type selection when Z_FIXED used. Now the smallest block type is selected, for better compression.
• Fix a configure issue that discarded the provided CC definition.
• Correct incorrect inputs provided to the CRC functions. This mitigates a bug in Java.
• Repair prototypes and exporting of the new CRC functions.
• Fix inflateBack to detect invalid input with distances too far.

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Worth noting that we've already previously investigated CVE-2022-37434 and determined that Firefox isn't affected by it.

Comment 2

[Ryan VanderMeulen [:RyanVM]]

Try push:
https://treeherder.mozilla.org/jobs?repo=try&revision=9143d16b3dec598d1539a7e5f78efa512ace3e44

Comment 3

[Ryan VanderMeulen [:RyanVM]]

Attachment: Bug 1796811 - Update in-tree zlib to version 1.2.13. r=aosmond

Comment 4

[Ryan VanderMeulen [:RyanVM]]

Attachment: Bug 1796811 - Upgrade zlib to 1.2.13 for NSIS. r=glandium

Depends on D159950

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4dbff747acd9
Update in-tree zlib to version 1.2.13. r=aosmond
https://hg.mozilla.org/integration/autoland/rev/76b6f0105897
Upgrade zlib to 1.2.13 for NSIS. r=glandium

Comment 6

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/4dbff747acd9
https://hg.mozilla.org/mozilla-central/rev/76b6f0105897