Skip to content

zlib: reject truncated zstd input#64593

Open
Archkon wants to merge 1 commit into
nodejs:mainfrom
Archkon:zlib
Open

zlib: reject truncated zstd input#64593
Archkon wants to merge 1 commit into
nodejs:mainfrom
Archkon:zlib

Conversation

@Archkon

@Archkon Archkon commented Jul 19, 2026

Copy link
Copy Markdown
Contributor

Fixes: #64592

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. zlib Issues and PRs related to the zlib subsystem. labels Jul 19, 2026
@Archkon
zlib: reject truncated zstd input
0efe9d3 
Treat an unfinished Zstd frame as an unexpected end of file when the
stream is finalized with ZSTD_e_end.

Avoid reporting an error while the output buffer still needs to be
drained or when an empty final write follows a completed frame. Preserve
partial decompression when ZSTD_e_flush is used.

Signed-off-by: Archkon <180910180+Archkon@users.noreply.github.com>
@codecov

codecov Bot commented Jul 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 93.75000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 90.13%. Comparing base (4f844f4) to head (0efe9d3).
⚠️ Report is 1 commits behind head on main.

Files with missing lines Patch % Lines
src/node_zlib.cc 93.75% 0 Missing and 1 partial ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #64593      +/-   ##
==========================================
- Coverage   90.13%   90.13%   -0.01%     
==========================================
  Files         741      741              
  Lines      241976   241991      +15     
  Branches    45543    45547       +4     
==========================================
- Hits       218116   218110       -6     
  Misses      15379    15379              
- Partials     8481     8502      +21
Files with missing lines Coverage Δ
src/node_zlib.cc 78.34% <93.75%> (-0.16%) ⬇️

... and 26 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@islandryu islandryu added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 19, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 19, 2026
@nodejs-github-bot

nodejs-github-bot commented Jul 19, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/74890/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jasnell jasnell jasnell approved these changes
@islandryu islandryu islandryu approved these changes

Assignees

No one assigned

Labels

c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. zlib Issues and PRs related to the zlib subsystem.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

zlib: Zstd decompression silently accepts truncated input

4 participants

@Archkon @nodejs-github-bot @jasnell @islandryu