Potential Vulnerability in Cloned Code

[tabudz]

Summary

Our tool detected a potential vulnerability in deps/abc/src/misc/zlib/inffast.c which was cloned from madler/zlib but did not receive the security patch applied in madler/zlib. The original issue was reported and fixed under https://nvd.nist.gov/vuln/detail/cve-2016-9841.

Proposed Fix

Apply the same patch as the one in madler/zlib to eliminate the vulnerability.

Reference

https://nvd.nist.gov/vuln/detail/cve-2016-9841 https://github.com/madler/zlib/commit/9aaec95e82117c1cb0f9624264c3618fc380cecb