Re: zlib 1.4 compatible?

[Patrick Steinhardt <ps@pks.im>]

On Mon, Nov 09, 2026 at 03:14:27PM +0100, Sven Strickroth wrote:
> Hi,
> 
> zlib 1.4 was released recently to fix security issues, however, at the same
> time it introduces potentially breaking changes (cf.
> <https://github.com/madler/zlib/releases/tag/v1.4>) such as:
> 
> > Raw deflate that completes exactly at the end of the output buffer now
> returns Z_STREAM_END instead of Z_OK, as documented.
> 
> Does this affect glib?

You probably mean Git, not glib.

So this breaking change is only contained to raw deflate, and we only
use that in "archive-zip.c". And as `Z_STREAM_END` can only trigger with
`Z_FINISH` there's only two loops here that we need to vet:

	buffer = xmalloc(maxsize);
        ...

	do {
		result = git_deflate(&stream, Z_FINISH);
	} while (result == Z_OK);

This one shoulud be fine, as we estimate the maximum bounds and then
decompress everything into that buffer. So even when we see Z_STREAM_END
we'd write the results into that buffer as expected.

And the second one:

	if (result != Z_STREAM_END) {
		free(buffer);
		return NULL;
	}

	do {
		result = git_deflate(&zstream, Z_FINISH);
		if (result != Z_OK && result != Z_STREAM_END)
			die("deflate error (%d)", result);

		out_len = zstream.next_out - compressed;
		if (out_len > 0) {
			write_or_die(1, compressed, out_len);
			compressed_size += out_len;
			zstream.next_out = compressed;
			zstream.avail_out = sizeof(compressed);
		}
	} while (result != Z_STREAM_END);

This one looks fine to me, as we process the result just fine on
Z_STREAM_END.

So I don't think that zlib 1.4 causes any issues for us.

Patrick