zlib: reject reset after gzip emitted incomplete output - #66179
Merged
nodejs-github-bot merged 2 commits intoSep 26, 2026
Merged
Conversation
deflateReset starts a new member. Bytes already written out cannot be taken back, so gunzip/inflate see a truncated member followed by a new header. Refuse reset in that case. Raw deflate has no wrapper header and is unchanged. Signed-off-by: Xia Chao <shapirolutts@gmail.com>
nodejs-github-bot
added
c++
jasnell
approved these changes
Sep 21, 2026
zlib-wrapped deflate still allows reset after flush. The dictionary test discards the first member and reuses the compressor. Signed-off-by: Xia Chao <shapirolutts@gmail.com>
xia-chao
changed the title
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #66179 +/- ##
=======================================
Coverage 90.28% 90.29%
=======================================
Files 790 790
Lines 272043 272062 +19
Branches 51945 51945
=======================================
+ Hits 245619 245650 +31
+ Misses 16931 16916 -15
- Partials 9493 9496 +3
🚀 New features to boost your workflow:
|
Contributor
Author
|
Thanks for the review! Narrowed this to gzip only in a follow-up commit — could you take another look? |
jasnell
approved these changes
Sep 22, 2026
jasnell
added
the
request-ci
github-actions
Bot
removed
the
request-ci
Collaborator
panva
added
author ready
nodejs-github-bot
added
the
lacks-second-approval
panva
approved these changes
Sep 26, 2026
Collaborator
|
Landed in ca0810f |
nodejs-github-bot
removed
commit-queue
aduh95
pushed a commit
that referenced
this pull request
Sep 27, 2026
deflateReset starts a new member. Bytes already written out cannot be taken back, so gunzip/inflate see a truncated member followed by a new header. Refuse reset in that case. Raw deflate has no wrapper header and is unchanged. Signed-off-by: Xia Chao <shapirolutts@gmail.com> PR-URL: #66179 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com>
HoonDongKang
pushed a commit
to HoonDongKang/node
that referenced
this pull request
Sep 28, 2026
deflateReset starts a new member. Bytes already written out cannot be taken back, so gunzip/inflate see a truncated member followed by a new header. Refuse reset in that case. Raw deflate has no wrapper header and is unchanged. Signed-off-by: Xia Chao <shapirolutts@gmail.com> PR-URL: nodejs#66179 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com>
aduh95
pushed a commit
that referenced
this pull request
Sep 28, 2026
deflateReset starts a new member. Bytes already written out cannot be taken back, so gunzip/inflate see a truncated member followed by a new header. Refuse reset in that case. Raw deflate has no wrapper header and is unchanged. Signed-off-by: Xia Chao <shapirolutts@gmail.com> PR-URL: #66179 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Filip Skokan <panva.ip@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
gzip writes a header on the first write. Calling reset after that starts a new member while that header is already in the output, so gunzip fails.
Same idea as the zstd incomplete-frame case in #66088, but only for gzip. zlib deflate can still reset after a flush: the dictionary test throws the first output away and reuses the compressor. Raw deflate is unchanged.
reset before any write still works. flush then end, without reset, still works.
I ran the new gzip reset test, the dictionary test, the existing reset tests, test-zlib.js, and the flush tests on a Release build.