deflate() emits zlib header and resets adler unconditionally β stream corruption for any non-single-shot caller
Summary
hammer2_zlib_deflate.c:391-415 deflate() computes CMF header putShortMSB(s,header) :408 and resets strm->adler=adler32(0,...) :415 on EVERY entry with NO guard. Upstream zlib 1.2.8 wraps this in if(s->status==INIT_STATE) and has #ifdef GZIP wrap==2 branch β both stripped during vendoring (grep INIT_STATE only at :304/:521 never as guard). Sole in-tree caller hammer2_strategy.c:987-1006 uses single-shot deflate(Z_FINISH) so header written exactly once current on-disk blocks valid NO memory-safety/info-leak/priv-esc impact. Latent: any future incremental caller gets duplicate CMF/FLG bytes mid-stream + wrong Adler-32 trailer = blocks that inflate cannot validate = read-time data loss/DoS. Fix: restore if(s->status==INIT_STATE) guard.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0826 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 409 B | view raw |
Fix verification
not_testablerecommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
Confirmed kernel references
β
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/vfs/hammer2/zlib/hammer2_zlib_deflate.c:391: deflate emits zlib header and resets adler unconditionally (stream corruption)
Verified recommended fix
Source-confirmed at sys/vfs/hammer2/zlib/hammer2_zlib_deflate.c:391: deflate emits zlib header and resets adler unconditionally (stream corruption)
Verdict
Source-confirmed at sys/vfs/hammer2/zlib/hammer2_zlib_deflate.c:391: deflate emits zlib header and resets adler unconditionally (stream corruption)
No comments yet.