Description:security: Fix CVE-2022-37434
Sig:SIG_ApplicaitonFramework
Feature or Bugfix:Bugfix
Binary Source:No
Signed-off-by: Nwanghang <wanghang26@huawei.com>
Change-Id: If307873d4eeb639f4c86ac7ca4dd2057e9522070

This verifies that the state has been initialized, that it is the
expected type of state, deflate or inflate, and that at least the
first several bytes of the internal state have not been clobbered.

The undocumented (except in these commit comments) function
inflateValidate(strm, check) can be called after an inflateInit(),
inflateInit2(), or inflateReset2() with check equal to zero to
turn off the check value (CRC-32 or Adler-32) computation and
comparison. Calling with check not equal to zero turns checking
back on. This should only be called immediately after the init or
reset function. inflateReset() does not change the state, so a
previous inflateValidate() setting will remain in effect.

This also turns off validation of the gzip header CRC when
present.

This should only be used when a zlib or gzip stream has already
been checked, and repeated decompressions of the same stream no
longer need to be validated.

When windowBits is zero, the size of the sliding window comes from
the zlib header.  The allowed values of the four-bit field are
0..7, but when windowBits is zero, values greater than 7 are
permitted and acted upon, resulting in large, mostly unused memory
allocations.  This fix rejects such invalid zlib headers.

The C standard says that bit shifts of negative integers is
undefined.  This casts to unsigned values to assure a known
result.

A windowBits value of 0, 16, or 32 gets the window bits from the
zlib header.  However there is no zlib header for 16, or for 32
when the input is gzip.  This commit sets the window bits for
inflate to 15 if a gzip stream is detected and windowBits was 16
or 32.

This patch allows zlib to compile cleanly with the -Wcast-qual gcc
warning enabled, but only if ZLIB_CONST is defined, which adds
const to next_in and msg in z_stream and in the in_func prototype.
A --const option is added to ./configure which adds -DZLIB_CONST
to the compile flags, and adds -Wcast-qual to the compile flags
when ZLIBGCCWARN is set in the environment.

inflate() avoided that allocation normally, until it was modified to
update the window on a normal completion so that inflateResetKeep()
could work.  This patch restores that behavior, but only when
Z_FINISH is used successfully to complete an inflation of a stream in
a single call of inflate().  The comments in zlib.h have been updated
accordingly.

This patch adds the deflateResetKeep() function to retain the sliding
window for the next deflate operation, and fixes an inflateResetKeep()
problem that came from inflate() not updating the window when the
stream completed.  This enables constructing and decompressing a series
of concatenated deflate streams where each can depend on the history of
uncompressed data that precedes it.

This generalizes deflateSetDictionary() and inflateSetDictionary() to
permit setting the dictionary in the middle of a stream for raw deflate
and inflate.  This in combination with the Keep functions enables a
scheme for updating files block by block with the transmission of
compressed data, where blocks are sent with deflateResetKeep() to
retain history for better compression, and deflateSetDictionary() is
used for blocks already present at the receiver to skip compression but
insert that data in the history, again for better compression.  The
corresponding inflate calls are done on the receiver side.

During coverage testing it was discovered that these two lines could
never pull more bits, since the immediately preceding for loop assures
that all of the code's bits are already pulled.

The Microsoft CAB file format compresses each block with completed
deflate streams that depend on the sliding window history of the
previous block in order to decode.  inflateResetKeep() does what
inflateReset() does, except the sliding window history from the
previous inflate operation is retained.

A common request has been the ability to compile zlib to require no
other libraries.  This --solo option provides that ability.  The price
is that the gz*, compress*, and uncompress functions are eliminated,
and that the user must provide memory allocation and free routines to
deflate and inflate when initializing.