3 ms·

needs (Aug) btw. Does this affect zlib-ng also? Once I've looked into zlib code a few years ago, I abandoned it. It's a mess, only comparable to openssl, sqli

by rurban 4y ago

needs (Aug) btw. Does this affect zlib-ng also? Once I've looked into zlib code a few years ago, I abandoned it. It's a mess, only comparable to openssl, sqlite and bash.

SahAssar 4y ago
> It's a mess, only comparable to openssl, sqlite and bash. Why do you consider sqlite abandoned or a mess?
- rurban 4y ago
  because is almost impossible to fix, harden or make secure. it's not just the broken overall architecture, which eg enables write on read, also it's internal code. eg the various attempts to get FTS. it's worse than openssl, which gets all the FLAC
  - SahAssar 4y ago
    > because is almost impossible to fix, harden or make secure. I'd like some more context on this. Especially since it is used in many security-critical contexts currently.
    - rurban 4y ago
      https://github.com/rurban/hardsqlite https://github.com/rurban/hardsqlite I gave up on it
jomar 4y ago
Zlib-ng doesn't contain the same code, but it appears that their equivalent inflate() when used with their inflateGetHeader() implementation was affected by a similar problem: https://github.com/zlib-ng/zlib-ng/pull/1328 https://github.com/zlib-ng/zlib-ng/pull/1328 Also similarly, most client code will be unaffected because `state->head` will be NULL, because they (most client code) won't have used inflateGetHeader() at all.