# zit 0.3.29

zit 0.3.29 fixes a crash in the zlib decoder that every sync request and
reply passes through. Any peer could trigger it with 32 bytes.

No artifact, tag namespace, sync message, or on-disk repository format
changed.

## A truncated dynamic-block header no longer crashes the decoder

The nightly fuzz soak failed four nights running on the same target,
`sync_container_round_trip`, each time with a different random seed and
each time as a bare segmentation fault. The cause was in the inflate zit
carries from Zig 0.16's standard library, and it's the same kind of slip as
the one the soak found there a week ago: end-of-input bit accounting.

Before tossing a code-length symbol, `tossBitsShort` checks that enough bits
remain. It computed them as `bufferedLen() * 8 + consumed_bits`, adding the
bits already consumed from the current byte where it has to subtract them.
With one byte left and six of its bits consumed, a seven-bit toss passed the
check and advanced the reader past its end. The next peek sliced
`buffer[seek..end]` with `seek` past `end`, got a length of 2⁶⁴−1, and read
up the stack until it hit an unmapped page.

Random garbage reaches it: the soak's input was 32 bytes whose dynamic-block
header ends one byte short. A peer could send the same bytes as a sync
request or reply. The check is now written without subtraction, like the
earlier fix, so a short header is just the end of the stream and `decode`
returns an error.

The regression test is the soak's own input. It panics a Debug build without
the fix and passes with it. All four nights' seeds pass at the soak's round
count. The vendored file's header now records both fixes.

A note on why it was hard to see. A unit test on the captured bytes passed
at first, because it used a 1 MiB output cap and these bytes declare 287 MB,
so `decode` refused them before the inflate ran. The fuzzer uses the
protocol's own reply cap. The test now admits the declared size.

## The soak stops at its first failure

The four failures also hid something. The soak stops at the first failing
target, and `sync_container_round_trip` is sixteenth of twenty-eight. The
twelve after it, including `transport_frame_garbage`, which drives this same
decoder, and `serve_request_garbage`, got no deep run for four nights. A full
soak was dispatched with this release to cover them.

## Compatibility

- No on-disk repository or wire format changed; Fossil RFC revision 00
  remains the target.
- A container whose zlib stream ends partway through a dynamic block header
  is now refused with an error instead of crashing the process.

## Qualification

`zig fmt --check`, `zig build test`, `e2e`, `smoke`, `git-import-e2e`,
`git-export-e2e`, `dst`, and every fuzz target at 256 rounds, plus the
three-runner CI battery and a full-depth soak.