当前Pull Request已关闭, 关闭人@wu-jinpeng981212
wu-jinpeng981212start build
分支 OpenHarmony-4.0-Release 暂停触发门禁： 4.x分支生命周期结束，门禁工程关闭，停止触发。
OpenHarmony-4.0-Release所有代码仓合入受控, 请联系分支负责人@aiyongfu: aiyongfu@huawei.com, @five-yuan: wuyunjie@huawei.com, @RayShih: shirui721@huawei.com, @lnlan: lanleinan4@huawei.com, @shermanzhong: sherman.zhong@huawei.com, @wenyuhe: wenyuhe3@huawei.com, @albert-road: xululu1@huawei.com, @lixingchi1: lixingchi1@huawei.com任一人评审并评论approve
感谢提交 Pull Requests！如果您提交的PR已经开发完毕，请评论 "start build" 触发门禁，更多交互操作，请访问OpenHarmony社区支持命令清单。如果需要调整订阅PR、Issue的变更状态，请访问订阅链接。
Thanks for submitting the pull request. If your Pull Request has already been developed, you can leave a "start build" comment to trigger the gated system. For more commands, please visit OpenHarmony Command List. If you need to change the subscription of a Pull Request or Issue, please visit the link.
closes #241
Backport of the zlib 1.3.2 fix for CVE-2026-27171, adapted to this branch's vendored zlib 1.2.x (K&R-style definitions).
Vulnerability:
x2nmodp()had no negative-n guard; negative len2 throughcrc32_combine64()/crc32_combine_gen64()drovewhile(n) n >>= 1without terminating → unbounded CPU consumption.Fix (1 file):
if (len2 < 0) return 0;in both combine entry points;x2nmodp()widened touLong(K&R definition + OF() prototype); call-site casts.Reachability: crc32.c in libz (BUILD.gn). DCO Signed-off-by present.
Upstream: https://github.com/madler/zlib/releases/tag/v1.3.2
(generated by ohos-cve-autofix)