已关闭
fix: CVE-2026-27171 crc32_combine CPU consumption (zlib 1.2.x backport) [OpenHarmony-4.1-Release] #123
wu-jinpeng981212创建于 22 天前关闭于 1 天前
fix: CVE-2026-27171 crc32_combine CPU consumption (zlib 1.2.x backport) [OpenHarmony-4.1-Release] #123
已关闭
当前Pull Request已关闭, 关闭人@wu-jinpeng981212
wu-jinpeng98121222 天前 关联了issue：[security] CVE-2026-27171: crc32_combine CPU consumption — backport to OpenHarmony-4.1-Release (zlib 1.2.x)
22 天前 关联了issue：[security] CVE-2026-27171: crc32_combine CPU consumption — backport to OpenHarmony-4.1-Release (zlib 1.2.x)
wu-jinpeng981212
22 天前 评论：
22 天前 评论：
start build
openharmony_ci
22 天前 评论：
22 天前 评论：
分支 OpenHarmony-4.1-Release 暂停触发门禁： 4.x门禁工程关闭，禁止触发。
openharmony_ci
22 天前 评论：
22 天前 评论：
OpenHarmony-4.1-Release所有代码仓合入受控, 请联系分支负责人@aiyongfu: aiyongfu@huawei.com, @shermanzhong: sherman.zhong@huawei.com, @wenyuhe: wenyuhe3@huawei.com, @albert-road: xululu1@huawei.com, @RayShih: shirui721@huawei.com任一人评审并评论approve
22 天前 添加了label：分支负责人未批准合入
22 天前 添加了label：waiting_on_author
openharmony_ci
22 天前 评论：
22 天前 评论：
感谢提交 Pull Requests！如果您提交的PR已经开发完毕，请评论 "start build" 触发门禁，更多交互操作，请访问OpenHarmony社区支持命令清单。如果需要调整订阅PR、Issue的变更状态，请访问订阅链接。
Thanks for submitting the pull request. If your Pull Request has already been developed, you can leave a "start build" comment to trigger the gated system. For more commands, please visit OpenHarmony Command List. If you need to change the subscription of a Pull Request or Issue, please visit the link.
22 天前 添加了label：dco检查成功
1 天前 关闭了 pull request
closes #242
Backport of the zlib 1.3.2 fix for CVE-2026-27171, adapted to this branch's vendored zlib 1.2.x (K&R-style definitions).
Vulnerability:
x2nmodp()had no negative-n guard; negative len2 throughcrc32_combine64()/crc32_combine_gen64()drovewhile(n) n >>= 1without terminating → unbounded CPU consumption.Fix (1 file):
if (len2 < 0) return 0;in both combine entry points;x2nmodp()widened touLong(K&R definition + OF() prototype); call-site casts.Reachability: crc32.c in libz (BUILD.gn). DCO Signed-off-by present.
Upstream: https://github.com/madler/zlib/releases/tag/v1.3.2
(generated by ohos-cve-autofix)