Control: found -1 1:1.2.13.dfsg-1 Control: found -1 1:1.3.dfsg+really1.3.1-1
The CVE text limits the affected range to 1.3.1.2 through 1.3.2. That range is too narrow. The overflow predates non-blocking write support: I reproduced it under ASan on upstream 1.2.11 and 1.2.13 in both gz_write() and gzvprintf(). The direct-path code involved dates from 1.2.3.5. No write stall is needed to reach it. Any gz_comp() failure on the direct path leaves the same state, so a descriptor opened read-only reproduces it without sockets or timing. Method and per-patch results are in my comment on the upstream issue: https://github.com/madler/zlib/issues/1292#issuecomment-5562455575 Upstream fix, already noted in the tracker: https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148 The commit applies to the bookworm and trixie sources as well as sid, so a backport of that single hunk covers all three. Steve Antonakakis
