Version in base suite: 1.3.dfsg+really1.3.1-1 Base version: zlib_1.3.dfsg+really1.3.1-1 Target version: zlib_1.3.dfsg+really1.3.1-1+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/z/zlib/zlib_1.3.dfsg+really1.3.1-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/z/zlib/zlib_1.3.dfsg+really1.3.1-1+deb13u1.dsc changelog | 10 + patches/Check-for-negative-lengths-in-crc32_combine-function.patch | 60 ++++++++++ patches/Fix-buffer-overflow-bug-in-non-blocking-gzwrite.patch | 28 ++++ patches/series | 2 4 files changed, 100 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpj70s_d3x/zlib_1.3.dfsg+really1.3.1-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpj70s_d3x/zlib_1.3.dfsg+really1.3.1-1+deb13u1.dsc: no acceptable signature found diff -Nru zlib-1.3.dfsg+really1.3.1/debian/changelog zlib-1.3.dfsg+really1.3.1/debian/changelog --- zlib-1.3.dfsg+really1.3.1/debian/changelog 2024-05-10 09:32:36.000000000 +0000 +++ zlib-1.3.dfsg+really1.3.1/debian/changelog 2026-11-01 05:57:53.000000000 +0000 @@ -1,3 +1,13 @@ +zlib (1:1.3.dfsg+really1.3.1-1+deb13u1) trixie-security; urgency=high + + * Non-maintainer upload by the Security Team. + * Check for negative lengths in crc32_combine functions (CVE-2026-27171) + (Closes: #1128336) + * Fix buffer overflow bug in non-blocking gzwrite (CVE-2026-85091) + (Closes: #1146895) + + -- Salvatore Bonaccorso Sun, 01 Nov 2026 06:57:53 +0100 + zlib (1:1.3.dfsg+really1.3.1-1) unstable; urgency=low * New upstream release. diff -Nru zlib-1.3.dfsg+really1.3.1/debian/patches/Check-for-negative-lengths-in-crc32_combine-function.patch zlib-1.3.dfsg+really1.3.1/debian/patches/Check-for-negative-lengths-in-crc32_combine-function.patch --- zlib-1.3.dfsg+really1.3.1/debian/patches/Check-for-negative-lengths-in-crc32_combine-function.patch 1970-01-01 00:00:00.000000000 +0000 +++ zlib-1.3.dfsg+really1.3.1/debian/patches/Check-for-negative-lengths-in-crc32_combine-function.patch 2026-10-29 22:33:09.000000000 +0000 @@ -0,0 +1,60 @@ +From: Mark Adler +Date: Sun, 21 Dec 2025 18:17:56 -0800 +Subject: Check for negative lengths in crc32_combine functions. +Origin: https://github.com/madler/zlib/commit/ba829a458576d1ff0f26fc7230c6de816d1f6a77 +Bug-Debian: https://bugs.debian.org/1128336 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-27171 + +Though zlib.h says that len2 must be non-negative, this avoids the +possibility of an accidental infinite loop. +--- + crc32.c | 4 ++++ + zlib.h | 4 ++-- + 2 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/crc32.c b/crc32.c +index 6c38f5c04c6a..33d8c7953d84 100644 +--- a/crc32.c ++++ b/crc32.c +@@ -1019,6 +1019,8 @@ unsigned long ZEXPORT crc32(unsigned long crc, const unsigned char FAR *buf, + + /* ========================================================================= */ + uLong ZEXPORT crc32_combine64(uLong crc1, uLong crc2, z_off64_t len2) { ++ if (len2 < 0) ++ return 0; + #ifdef DYNAMIC_CRC_TABLE + once(&made, make_crc_table); + #endif /* DYNAMIC_CRC_TABLE */ +@@ -1032,6 +1034,8 @@ uLong ZEXPORT crc32_combine(uLong crc1, uLong crc2, z_off_t len2) { + + /* ========================================================================= */ + uLong ZEXPORT crc32_combine_gen64(z_off64_t len2) { ++ if (len2 < 0) ++ return 0; + #ifdef DYNAMIC_CRC_TABLE + once(&made, make_crc_table); + #endif /* DYNAMIC_CRC_TABLE */ +diff --git a/zlib.h b/zlib.h +index f7aded9aac16..2881da71c6b5 100644 +--- a/zlib.h ++++ b/zlib.h +@@ -1848,14 +1848,14 @@ ZEXTERN uLong ZEXPORT crc32_combine(uLong crc1, uLong crc2, z_off_t len2); + seq1 and seq2 with lengths len1 and len2, CRC-32 check values were + calculated for each, crc1 and crc2. crc32_combine() returns the CRC-32 + check value of seq1 and seq2 concatenated, requiring only crc1, crc2, and +- len2. len2 must be non-negative. ++ len2. len2 must be non-negative, otherwise zero is returned. + */ + + /* + ZEXTERN uLong ZEXPORT crc32_combine_gen(z_off_t len2); + + Return the operator corresponding to length len2, to be used with +- crc32_combine_op(). len2 must be non-negative. ++ crc32_combine_op(). len2 must be non-negative, otherwise zero is returned. + */ + + ZEXTERN uLong ZEXPORT crc32_combine_op(uLong crc1, uLong crc2, uLong op); +-- +2.55.0 + diff -Nru zlib-1.3.dfsg+really1.3.1/debian/patches/Fix-buffer-overflow-bug-in-non-blocking-gzwrite.patch zlib-1.3.dfsg+really1.3.1/debian/patches/Fix-buffer-overflow-bug-in-non-blocking-gzwrite.patch --- zlib-1.3.dfsg+really1.3.1/debian/patches/Fix-buffer-overflow-bug-in-non-blocking-gzwrite.patch 1970-01-01 00:00:00.000000000 +0000 +++ zlib-1.3.dfsg+really1.3.1/debian/patches/Fix-buffer-overflow-bug-in-non-blocking-gzwrite.patch 2026-11-01 05:57:24.000000000 +0000 @@ -0,0 +1,28 @@ +From: Mark Adler +Date: Wed, 16 Sep 2026 16:26:14 -0700 +Subject: [PATCH] Fix buffer overflow bug in non-blocking gzwrite. + +This addresses CVE-2026-85091. + +[Salvatore Bonaccorso: Backport fix to version before 81cc0bebedd9 ("Support +non-blocking devices in the gz* routines.").] +Thanks: Tobias Frost and Shafayat Hossain Majumder +--- + gzwrite.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/gzwrite.c ++++ b/gzwrite.c +@@ -241,8 +241,11 @@ + n = (unsigned)len; + state->strm.avail_in = n; + state->x.pos += n; +- if (gz_comp(state, Z_NO_FLUSH) == -1) ++ if (gz_comp(state, Z_NO_FLUSH) == -1) { ++ state->strm.avail_in = 0; ++ state->strm.next_in = state->in; + return 0; ++ } + len -= n; + } while (len); + } diff -Nru zlib-1.3.dfsg+really1.3.1/debian/patches/series zlib-1.3.dfsg+really1.3.1/debian/patches/series --- zlib-1.3.dfsg+really1.3.1/debian/patches/series 2024-05-10 09:32:36.000000000 +0000 +++ zlib-1.3.dfsg+really1.3.1/debian/patches/series 2026-10-29 22:37:15.000000000 +0000 @@ -0,0 +1,2 @@ +Check-for-negative-lengths-in-crc32_combine-function.patch +Fix-buffer-overflow-bug-in-non-blocking-gzwrite.patch