Update vendored zlib to 1.4

cgmanifest.json

@@ -26,7 +26,7 @@
         "Type": "git",
         "git": {
           "RepositoryUrl": "https://github.com/madler/zlib",
-          "CommitHash": "da607da739fa6047df13e66a2af6b8bec7c2a498"
+          "CommitHash": "99623ef7097352da7993ba614161fd6a311e046e"
         }
       },
       "DevelopmentDependency": false

zlib/CMakeLists.txt

@@ -3,7 +3,8 @@ set(CMAKE_ALLOW_LOOSE_LOOP_CONSTRUCTS ON)
 
 project(zlib C)
 
-set(VERSION "1.3.2")
+set(VERSION "1.4")
+set(zlib_VERSION "${VERSION}")
 
 option(ASM686 "Enable building i686 assembly implementation")
 option(AMD64 "Enable building amd64 assembly implementation")
@@ -14,6 +15,9 @@ set(INSTALL_INC_DIR "${CMAKE_INSTALL_PREFIX}/include" CACHE PATH "Installation d
 set(INSTALL_MAN_DIR "${CMAKE_INSTALL_PREFIX}/share/man" CACHE PATH "Installation directory for manual pages")
 set(INSTALL_PKGCONFIG_DIR "${CMAKE_INSTALL_PREFIX}/share/pkgconfig" CACHE PATH "Installation directory for pkgconfig (.pc) files")
 
+set(pc_libdir "${INSTALL_LIB_DIR}")
+set(pc_includedir "${INSTALL_INC_DIR}")
+
 include(CheckTypeSize)
 include(CheckFunctionExists)
 include(CheckIncludeFile)
@@ -226,7 +230,7 @@ add_test(example example)
 add_executable(minigzip test/minigzip.c)
 target_link_libraries(minigzip zlib)
 
-if(HAVE_OFF64_T)
+if(HAVE_OFF64_T OR WIN32)
     add_executable(example64 test/example.c)
     target_link_libraries(example64 zlib)
     set_target_properties(example64 PROPERTIES COMPILE_FLAGS "-D_FILE_OFFSET_BITS=64")

zlib/ChangeLog

@@ -1,6 +1,37 @@
 
                 ChangeLog file for zlib
 
+Changes in 1.4 (4 Nov 2026)
+- Change CMake library names on MSVC
+- Return z_off_t default to long for portability
+- Fail gzopen() with "x" if O_EXCL not available
+- Deliver all gzip data before reporting error
+- Fix gzwrite() buffer overflow (CVE-2026-85091)
+- Fix inflateGetDictionary() write past buffer on invalid window size
+- Fix window write overrun after inflateSync()
+- Fix read before provided data after repeated inflatePrime()'s
+- Fix write past pending buffer after repeated deflatePrime()'s
+- Fix copy of uninitialized memory by inflateBack() on invalid data
+- Fix copy of uninitialized memory after gzseek() as first write action
+- Fix read outside window after a deflateResetKeep() mid-stream
+- Avoid out-of-bounds pointer arithmetic in infback9() (CVE-2026-4738)
+- Fix several vulnerabilities in contrib/minizip
+- Fix truncated stream detection in gzread()
+- Fix pending skip handling in gzread()
+- Fix loss of zero fill on repeated gzseek()'s when writing
+- Fix inaccurate total_in after Z_NEED_DICT returned
+- Detect and report bad deflateSetDictionary() calls
+- Avoid undefined behaviors in C language usage
+- Fix minizip extra field overflows when almost full and need Zip64
+- Don't assume NULL is defined in compress.c and uncompr.c
+- Use the generated zconf.h when building test programs out of tree
+- Improve portability and functionality of CMake builds
+- Provide 64-bit file offsets on Windows with #defines as on Linux
+- Improve portability to Android, AIX, PowerPC, s390x, and Windows
+- Use a PCG random number generator instead of rand() in minizip
+- Clarify documentation
+- (See https://github.com/madler/zlib for all 195 commits)
+
 Changes in 1.3.2 (17 Feb 2026)
 - Continued rewrite of CMake build [Vollstrecker]
 - Various portability improvements

zlib/Makefile.in

@@ -31,7 +31,7 @@ VGFMAFLAG=
 
 STATICLIB=libz.a
 SHAREDLIB=libz.so
-SHAREDLIBV=libz.so.1.3.2
+SHAREDLIBV=libz.so.1.4
 SHAREDLIBM=libz.so.1
 LIBS=$(STATICLIB) $(SHAREDLIBV)
 
@@ -40,6 +40,8 @@ ARFLAGS=rc
 RANLIB=ranlib
 LDCONFIG=ldconfig
 LDSHAREDLIBC=-lc
+SHAREDEXP=
+SHAREDEXPFLAG=
 TAR=tar
 SHELL=/bin/sh
 EXE=
@@ -285,13 +287,21 @@ gzwrite.lo: $(SRCDIR)gzwrite.c
 	-@mv objs/gzwrite.o $@
 
 
-placebo $(SHAREDLIBV): $(PIC_OBJS) libz.a $(SRCDIR)zlib.map
-	$(LDSHARED) $(SFLAGS) -o $@ $(PIC_OBJS) $(LDSHAREDLIBC) $(LDFLAGS)
+placebo $(SHAREDLIBV): $(PIC_OBJS) libz.a $(SRCDIR)zlib.map $(SHAREDEXP)
+	$(LDSHARED) $(SFLAGS) $(SHAREDEXPFLAG) -o $@ $(PIC_OBJS) $(LDSHAREDLIBC) $(LDFLAGS)
 	rm -f $(SHAREDLIB) $(SHAREDLIBM)
 	ln -s $@ $(SHAREDLIB)
 	ln -s $@ $(SHAREDLIBM)
 	-@rmdir objs
 
+libz.exp: $(PIC_OBJS)
+	dump -tov -X 32_64 $(PIC_OBJS) | \
+	  awk '$$1 ~ /^\[[0-9]+\]$$/ && $$2 == "m" && \
+	       $$4 ~ /^\.(text|data|bss)$$/ && ($$6 == "extern" || $$6 == "weak") && \
+	       $$7 != "HIDDEN" && $$7 != "INTERNAL" && $$NF !~ /^\./ { print $$NF }' | \
+	  sort -u > $@
+	@test -s $@ || { echo "no symbols found for $@" >&2; rm -f $@; false; }
+
 example$(EXE): example.o $(STATICLIB)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ example.o $(TEST_LIBS)
 

zlib/compress.c

@@ -28,8 +28,8 @@ int ZEXPORT compress2_z(Bytef *dest, z_size_t *destLen, const Bytef *source,
     const uInt max = (uInt)-1;
     z_size_t left;
 
-    if ((sourceLen > 0 && source == NULL) ||
-        destLen == NULL || (*destLen > 0 && dest == NULL))
+    if ((sourceLen > 0 && source == Z_NULL) ||
+        destLen == Z_NULL || (*destLen > 0 && dest == Z_NULL))
         return Z_STREAM_ERROR;
 
     left = *destLen;

zlib/configure

@@ -26,7 +26,7 @@ if test $SRCDIR = "."; then
     SRCDIR=""
 else
     ZINC='-I. -include zconf.h'
-    ZINCOUT='-I. -I$(SRCDIR)'
+    ZINCOUT='-I. -I$(SRCDIR) -include zconf.h'
     SRCDIR="$SRCDIR/"
 fi
 
@@ -321,7 +321,9 @@ if test "$gcc" -eq 1 && ($cc -c $test.c) >> configure.log 2>&1; then
         esac ;;
   AIX*)
         LDSHARED=${LDSHARED-"$cc -shared"}
-        LDFLAGS="${LDFLAGS} -Wl,-brtl" ;;
+        LDFLAGS="${LDFLAGS} -Wl,-brtl"
+        SHAREDEXP=libz.exp
+        SHAREDEXPFLAG=-Wl,-bE:libz.exp ;;
   Darwin* | darwin* | *-darwin*)
         shared_ext='.dylib'
         SHAREDLIB=libz$shared_ext
@@ -403,6 +405,7 @@ else
          fi
          if test -n "$ZINC"; then
              ZINC='-I- -I. -I$(SRCDIR)'
+             ZINCOUT='-I- -I. -I$(SRCDIR)'
          fi
          ;;
   SunOS\ 4*) SFLAGS=${CFLAGS-"-O2 -PIC"}
@@ -507,6 +510,29 @@ else
   leave 1
 fi
 
+# turn off useless GCC 5 warning about PowerPC vector type alignments.
+if test "$gcc" -eq 1; then
+  cat > $test.c << EOF
+typedef int zvec __attribute__((vector_size(8)));
+struct zstruct { char c; zvec v; };
+int zfunc(struct zstruct *s) { return s->c; }
+EOF
+  echo "Checking for gcc vector ABI notes..." >> configure.log
+  show $CC -c $CFLAGS $test.c
+  got=`( $CC -c $CFLAGS $test.c ) 2>&1`
+  if test "$got" != ""; then
+    printf "%s\n" "$got" >> configure.log
+  fi
+  case "$got" in
+  *"changed in GCC 5"*)
+    if tryboth $CC -c $CFLAGS -Wno-psabi $test.c; then
+      echo "... turning the notes off with -Wno-psabi" >> configure.log
+      CFLAGS="${CFLAGS} -Wno-psabi"
+      SFLAGS="${SFLAGS} -Wno-psabi"
+    fi ;;
+  esac
+fi
+
 echo >> configure.log
 
 # see if shared library build supported
@@ -517,8 +543,15 @@ EOF
 if test $shared -eq 1; then
   echo Checking for shared library support... | tee -a configure.log
   # we must test in two steps (cc then ld), required at least on SunOS 4.x
+  # the second link test is for linkers like lld that by default reject a
+  # version script naming symbols that the test object doesn't define -- if
+  # that's needed, keep the option, since some builds (e.g. --solo) don't
+  # define all of the symbols in zlib.map
   if try $CC -c $SFLAGS $test.c &&
-     try $LDSHARED $SFLAGS $LDFLAGS -o $test$shared_ext $test.o; then
+     { try $LDSHARED $SFLAGS $LDFLAGS -o $test$shared_ext $test.o ||
+       { try $LDSHARED $SFLAGS $LDFLAGS -Wl,--undefined-version \
+             -o $test$shared_ext $test.o &&
+         LDSHARED="$LDSHARED -Wl,--undefined-version"; }; }; then
     echo Building shared library $SHAREDLIBV with $CC. | tee -a configure.log
   elif test -z "$old_cc" -a -z "$old_cflags"; then
     echo No shared library support. | tee -a configure.log
@@ -1024,6 +1057,7 @@ sed < ${SRCDIR}Makefile.in "
 /^LDFLAGS *=/s#=.*#=$LDFLAGS#
 /^LDSHARED *=/s#=.*#=$LDSHARED#
 /^CPP *=/s#=.*#=$CPP#
+/^VGFMAFLAG *=/s#=.*#=$VGFMAFLAG#
 /^STATICLIB *=/s#=.*#=$STATICLIB#
 /^SHAREDLIB *=/s#=.*#=$SHAREDLIB#
 /^SHAREDLIBV *=/s#=.*#=$SHAREDLIBV#
@@ -1033,6 +1067,8 @@ sed < ${SRCDIR}Makefile.in "
 /^RANLIB *=/s#=.*#=$RANLIB#
 /^LDCONFIG *=/s#=.*#=$LDCONFIG#
 /^LDSHAREDLIBC *=/s#=.*#=$LDSHAREDLIBC#
+/^SHAREDEXP *=/s#=.*#=$SHAREDEXP#
+/^SHAREDEXPFLAG *=/s#=.*#=$SHAREDEXPFLAG#
 /^EXE *=/s#=.*#=$EXE#
 /^SRCDIR *=/s#=.*#=$SRCDIR#
 /^ZINC *=/s#=.*#=$ZINC#
@@ -1054,6 +1090,7 @@ sed < ${SRCDIR}zlib.pc.in "
 /^CC *=/s#=.*#=$CC#
 /^CFLAGS *=/s#=.*#=$CFLAGS#
 /^CPP *=/s#=.*#=$CPP#
+/^VGFMAFLAG *=/s#=.*#=$VGFMAFLAG#
 /^LDSHARED *=/s#=.*#=$LDSHARED#
 /^STATICLIB *=/s#=.*#=$STATICLIB#
 /^SHAREDLIB *=/s#=.*#=$SHAREDLIB#

zlib/contrib/delphi/ZLib.pas

@@ -152,7 +152,7 @@ procedure DecompressToUserBuf(const InBuf: Pointer; InBytes: Integer;
   const OutBuf: Pointer; BufSize: Integer);
 
 const
-  zlib_version = '1.3.2';
+  zlib_version = '1.4';
 
 type
   EZlibError = class(Exception);

zlib/contrib/dotzlib/DotZLib/UnitTests.cs

@@ -156,7 +156,7 @@ public class InfoTests
         public void Info_Version()
         {
             Info info = new Info();
-            Assert.AreEqual("1.3.2", Info.Version);
+            Assert.AreEqual("1.4", Info.Version);
             Assert.AreEqual(32, info.SizeOfUInt);
             Assert.AreEqual(32, info.SizeOfULong);
             Assert.AreEqual(32, info.SizeOfPointer);

zlib/contrib/infback9/inftree9.c

@@ -9,7 +9,7 @@
 #define MAXBITS 15
 
 const char inflate9_copyright[] =
-   " inflate9 1.3.2 Copyright 1995-2026 Mark Adler ";
+   " inflate9 1.4 Copyright 1995-2026 Mark Adler ";
 /*
   If you use the zlib library in a product, an acknowledgment is welcome
   in the documentation of your product. If for some reason you cannot
@@ -49,7 +49,7 @@ int inflate_table9(codetype type, unsigned short FAR *lens, unsigned codes,
     code FAR *next;             /* next available space in table */
     const unsigned short FAR *base;     /* base value table to use */
     const unsigned short FAR *extra;    /* extra bits table to use */
-    int end;                    /* use base and extra for symbol > end */
+    unsigned match;             /* use base and extra for symbol >= match */
     unsigned short count[MAXBITS+1];    /* number of codes of each length */
     unsigned short offs[MAXBITS+1];     /* offsets in table for each length */
     static const unsigned short lbase[31] = { /* Length codes 257..285 base */
@@ -59,7 +59,7 @@ int inflate_table9(codetype type, unsigned short FAR *lens, unsigned codes,
     static const unsigned short lext[31] = { /* Length codes 257..285 extra */
         128, 128, 128, 128, 128, 128, 128, 128, 129, 129, 129, 129,
         130, 130, 130, 130, 131, 131, 131, 131, 132, 132, 132, 132,
-        133, 133, 133, 133, 144, 199, 75};
+        133, 133, 133, 133, 144, 71, 77};
     static const unsigned short dbase[32] = { /* Distance codes 0..31 base */
         1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49,
         65, 97, 129, 193, 257, 385, 513, 769, 1025, 1537, 2049, 3073,
@@ -170,19 +170,17 @@ int inflate_table9(codetype type, unsigned short FAR *lens, unsigned codes,
     switch (type) {
     case CODES:
         base = extra = work;    /* dummy value--not used */
-        end = 19;
+        match = 20;
         break;
     case LENS:
         base = lbase;
-        base -= 257;
         extra = lext;
-        extra -= 257;
-        end = 256;
+        match = 257;
         break;
     default:            /* DISTS */
         base = dbase;
         extra = dext;
-        end = -1;
+        match = 0;
     }
 
     /* initialize state for loop */
@@ -205,13 +203,13 @@ int inflate_table9(codetype type, unsigned short FAR *lens, unsigned codes,
     for (;;) {
         /* create table entry */
         this.bits = (unsigned char)(len - drop);
-        if ((int)(work[sym]) < end) {
+        if ((unsigned)(work[sym]) + 1 < match) {
             this.op = (unsigned char)0;
             this.val = work[sym];
         }
-        else if ((int)(work[sym]) > end) {
-            this.op = (unsigned char)(extra[work[sym]]);
-            this.val = base[work[sym]];
+        else if ((work[sym]) >= match) {
+            this.op = (unsigned char)(extra[work[sym]- match]);
+            this.val = base[work[sym]- match];
         }
         else {
             this.op = (unsigned char)(32 + 64);         /* end of block */