zit 0.3.29 fixes a crash in the zlib decoder that every sync request and reply passes through. Any peer could trigger it with 32 bytes.
No artifact, tag namespace, sync message, or on-disk repository format changed.
A truncated dynamic-block header no longer crashes the decoder
The nightly fuzz soak failed four nights running on the same target,
sync_container_round_trip, each time with a different random seed and
each time as a bare segmentation fault. The cause was in the inflate zit
carries from Zig 0.16's standard library, and it's the same kind of slip as
the one the soak found there a week ago: end-of-input bit accounting.
Before tossing a code-length symbol, tossBitsShort checks that enough bits
remain. It computed them as bufferedLen() * 8 + consumed_bits, adding the
bits already consumed from the current byte where it has to subtract them.
With one byte left and six of its bits consumed, a seven-bit toss passed the
check and advanced the reader past its end. The next peek sliced
buffer[seek..end] with seek past end, got a length of 2⁶⁴−1, and read
up the stack until it hit an unmapped page.
Random garbage reaches it: the soak's input was 32 bytes whose dynamic-block
header ends one byte short. A peer could send the same bytes as a sync
request or reply. The check is now written without subtraction, like the
earlier fix, so a short header is just the end of the stream and decode
returns an error.
The regression test is the soak's own input. It panics a Debug build without the fix and passes with it. All four nights' seeds pass at the soak's round count. The vendored file's header now records both fixes.
A note on why it was hard to see. A unit test on the captured bytes passed
at first, because it used a 1 MiB output cap and these bytes declare 287 MB,
so decode refused them before the inflate ran. The fuzzer uses the
protocol's own reply cap. The test now admits the declared size.
The soak stops at its first failure
The four failures also hid something. The soak stops at the first failing
target, and sync_container_round_trip is sixteenth of twenty-eight. The
twelve after it, including transport_frame_garbage, which drives this same
decoder, and serve_request_garbage, got no deep run for four nights. A full
soak was dispatched with this release to cover them.
Compatibility
- No on-disk repository or wire format changed; Fossil RFC revision 00 remains the target.
- A container whose zlib stream ends partway through a dynamic block header is now refused with an error instead of crashing the process.
Qualification
zig fmt --check, zig build test, e2e, smoke, git-import-e2e,
git-export-e2e, dst, and every fuzz target at 256 rounds, plus the
three-runner CI battery and a full-depth soak.