Skip to content

Return on a stalled non-blocking gzprintf write - #1281

Open
carrerasdarren-cell wants to merge 1 commit into
madler:developfrom
carrerasdarren-cell:agent/return-on-stalled-gzprintf
Open

Return on a stalled non-blocking gzprintf write#1281
carrerasdarren-cell wants to merge 1 commit into
madler:developfrom
carrerasdarren-cell:agent/return-on-stalled-gzprintf

Conversation

@carrerasdarren-cell

Copy link
Copy Markdown

Summary

  • return Z_BUF_ERROR immediately when a formatted gzip write stalls on a non-blocking destination
  • apply the same control-flow fix to both gzvprintf() and the legacy C89 gzprintf() implementation
  • preserve the existing retry contract instead of continuing to copy the same input into an exhausted output buffer

Fixes #1256.

Root cause

When pending gzip output cannot be flushed, both formatted-write paths record Z_BUF_ERROR but continue processing the same input. The write cursor can remain at the end of the allocation, allowing the following copy to write beyond the heap buffer.

Returning the recorded error at the stall point lets the caller wait for the descriptor to become writable and retry the same formatted write.

Validation

  • reproduced the untouched heap-buffer-overflow with a deterministic non-blocking pipe proof under AddressSanitizer
  • verified the patched sanitizer and release builds return Z_BUF_ERROR, successfully retry the same write after draining the pipe, and close with Z_OK
  • make -j4 test
  • make -j4 testshared

@carrerasdarren-cell
carrerasdarren-cell marked this pull request as ready for review July 15, 2026 20:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Heap buffer overflow in gzvprintf() after non-blocking write stall

1 participant