β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-0826

deflate() emits zlib header and resets adler unconditionally β€” stream corruption for any non-single-shot caller

Summary

hammer2_zlib_deflate.c:391-415 deflate() computes CMF header putShortMSB(s,header) :408 and resets strm->adler=adler32(0,...) :415 on EVERY entry with NO guard. Upstream zlib 1.2.8 wraps this in if(s->status==INIT_STATE) and has #ifdef GZIP wrap==2 branch β€” both stripped during vendoring (grep INIT_STATE only at :304/:521 never as guard). Sole in-tree caller hammer2_strategy.c:987-1006 uses single-shot deflate(Z_FINISH) so header written exactly once current on-disk blocks valid NO memory-safety/info-leak/priv-esc impact. Latent: any future incremental caller gets duplicate CMF/FLG bytes mid-stream + wrong Adler-32 trailer = blocks that inflate cannot validate = read-time data loss/DoS. Fix: restore if(s->status==INIT_STATE) guard.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-0826 Β· 1 files
FileTypeDescriptionSize
manifest.json file 409 B view raw

Fix verification

not_testable
baseline reproduced→ patch + rebuild →patched clean

recommended fix identified; fix.diff not authored/validated in this batch

recommended fix identified; fix.diff not authored/validated in this batch
combined build rc=0

Confirmed kernel references

β€”

Detail

Exploit chain

none (Info severity)

Evidence (decisive lines)

Source-confirmed at sys/vfs/hammer2/zlib/hammer2_zlib_deflate.c:391: deflate emits zlib header and resets adler unconditionally (stream corruption)

Verified recommended fix

Source-confirmed at sys/vfs/hammer2/zlib/hammer2_zlib_deflate.c:391: deflate emits zlib header and resets adler unconditionally (stream corruption)

Verdict

Source-confirmed at sys/vfs/hammer2/zlib/hammer2_zlib_deflate.c:391: deflate emits zlib header and resets adler unconditionally (stream corruption)