Unverified Commit 241eb612 authored by Myles Borins's avatar Myles Borins Committed by Anna Henningsen
Browse files

zlib: gracefully set windowBits from 8 to 9

On 4 April 2017, Node.js versions v4.8.2 and v6.10.2 were
released. These versions bumped the vendored zlib library from
v1.2.8 to v1.2.11 in response to what it describes as low-severity
CVEs. In zlib v1.2.9, a change was made that causes an error to be
raised when a raw deflate stream is initialised with windowBits set
to 8.

In zlib v1.2.9, 8 become an invalid value for this parameter, and Node's zlib
module will crash if you call this:

```
zlib.createDeflateRaw({windowBits: 8})
```

On some versions this crashes Node and you cannot recover from it, while on some
versions it throws an exception. The permessage-deflate library up to
version v0.1.5 does make such a call with no try/catch

This commit reverts to the original behavior of zlib by gracefully changed
windowBits: 8 to windowBits: 9 for raw deflate streams.

Original-PR-URL: https://github.com/nodejs-private/node-private/pull/95


Reviewed-By: default avatarAnna Henningsen <anna@addaleax.net>
Reviewed-By: default avatarEvan Lucas <evanlucas@me.com>
Reviewed-By: default avatarMichael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: default avatarSam Roberts <vieuxtech@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/16511


Reviewed-By: default avatarLuigi Pinca <luigipinca@gmail.com>
Reviewed-By: default avatarJames M Snell <jasnell@gmail.com>
Reviewed-By: default avatarColin Ihrig <cjihrig@gmail.com>
Reviewed-By: default avatarMichael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: default avatarRefael Ackermann <refack@gmail.com>
parent 203b5483
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment