[UBUNTU 20.04] zlib: inflate() does not update strm.adler if DFLTCC is used

Thanks for reporting this, Ilya.
Can you please elaborate about the potential impact of this issue - that 'inflate() does not update strm.adler if DFLTCC is used'?
Especially because this is marked with severity medium, but the Ubuntu stable release update process (SRUs: https://wiki.ubuntu.com/StableReleaseUpdates) is generally in order to fix high-impact bugs.
With updating stable releases (like in this case 20.04 and 22.04) there is huge carefulness needed, and especially with updating key packages and libraries like zlib, since zlib has significant package reverse dependencies and a huge amount of reverse build dependencies (both in the thousands).
Furthermore a potential update will impact multi-millions of installations, cross architecture, and we won't do that for a non-critical bugs, that maybe even only impact a small number of installations.
However, there might be a little chance to piggy-back a fix like this with a more severe zlib update that might come up in future.

However, a chance would be to piggy-back a fix like this with a more severe zlib update that might come up in future.

------- Comment From <email address hidden> 2022-09-23 13:07 EDT-------
Hi, I am Eclipse OpenJ9 developer. This issue was exposed by Java Certification Kit running on RHEL 9 on z15+ and impacts all JDK versions (8,11,17, etc.) using system default settings. The JCK failure impacts our ability to certify Java SDKs on this platform/distro. Also, the incorrect alder32 result may cause functional issues to Java applications that depend on the result.

So the next step would be to get more clarity on the complexity of the patch that is required.
We have the (initial) PR 410 incl. in the zlib package, plus the patches from LP#1899621 and LP#1961427 on top.
Hence we cannot directly use the new version of PR 410: https://github.com/madler/zlib/pull/410
and also the zlib diff: https://github.com/madler/zlib/compare/e6aed68ff815be74855ec6a19d6ae35065a4adb4..171d0ff3c9ed40da0ac14085ab16b766b1162069#diff-325baa03829572a9f26b4bb8b3cada1ddc637854529d6a6cb111b8c3ca785620
seems to incl. more than just the fix for 'zlib: inflate() does not update strm.adler if DFLTCC is used'.

For example I'm pretty sure that the modifications in contrib/s390/dfltcc.c and infback.c (as listed in the zlib diff) are part of the fix, but since I'm not the author I am unsure if this is everything that's needed.
Are the changes in the crc32 needed on top?
I think the typo fixes can be largely neglected ...

Hence can you please provide us with a patch/backport for the minimal changes that are needed to fix 'zlib: inflate() does not update strm.adler if DFLTCC is used' and that applies on top of what's already in the zlib package (obviously after the quilt patches were applied)?
Ideally based on the kinetic package (but the zlib packages in jammy and focal are pretty close, hence I assume that a backport will apply there too.)

------- Comment on attachment From <email address hidden> 2022-09-27 20:08 EDT-------

Here is the patch for kinetic. It's just an one liner.

Ok, that's a (minimal) patch that can be handled nicely, thanks Ilya!

Test packages are now being build in the following PPA
for focal/20.04, jammy/22.04 and kinetic/22.10:
https://launchpad.net/~fheimes/+archive/ubuntu/lp1990379
https://launchpad.net/~fheimes/+archive/ubuntu/lp1990379/+packages

It would be great if someone (for example 'rahil'?!) could test (probably) at least the focal package upfront, to ensure that the situation is really solved, and with that, give us confidence for the SRU process.
(Please notice that this would be on top of the official verification request that will come up later during the SRU process).

debdiffs for F, J and K

The attachment "debdiffs.tgz" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

I've just noticed another bug that I want to fix with the same package update: LP#1982583
But LP#1982583 affects only jammy and kinetic, not focal.

This means for fixing this bug (LP#1990379) for jammy and kinetic, please use these debdiffs:
https://bugs.launchpad.net/ubuntu-z-systems/+bug/1982583/comments/2
and for fixing this bug (LP#1990379) for focal, please take the focal debdiff from the previous comment:
https://bugs.launchpad.net/ubuntu-z-systems/+bug/1990379/comments/7

I looked at the queues for focal and jammy but did not find any zlib uploads as indicated by "in progress" per SRU policy, so reset the status to "triaged".

Uploaded to Lunar, Kinetic, Jammy and Focal

It has been reported that this change breaks libxml2 (https://bugzilla.redhat.com/show_bug.cgi?id=2155328). The attached patch should fix the issue.

I've also proposed a fix and a new test for zlib-ng (https://github.com/zlib-ng/zlib-ng/pull/1390) in order to detect such breakages in the future.

Hi Ilya, yepp, breaking libxml2 is of course an issue.
Regarding the fix/patch, you attached here a patch named 'patch-1.2.11'.

We have currently the following package versions in the archive:
1.2.11.dfsg-2ubuntu1.5 | focal
1.2.11.dfsg-2ubuntu9.2 | jammy
1.2.11.dfsg-4.1ubuntu1 | kinetic
1.2.13.dfsg-1ubuntu3 | lunar-proposed

(After having tweaked the patch a bit regarding white-spaces...)
the patch applies fine on focal, jammy and kinetic.
I wondered if the patch is also for 1.2.13 (I think so, since the RH bug tells that), which is what we currently have in lunar-proposed - and it actually applies there fine too.

I just needed to open a separate LP bug for this, since I need a separate bug number to reference this fix/patch in the changelogs:
https://bugs.launchpad.net/bugs/2002511
So regarding the libxml(2) issue, the further work and communication will be there.

Ubuntu 22.10 (Kinetic Kudu) has reached end of life, so this bug will not be fixed for that specific release.

------- Comment From <email address hidden> 2023-10-17 10:45 EDT-------
Fix has been released to Focal, Jammy and Kinetic. With 22.10 being out of service, we can close the bug.

==> Changing the status to: "CLOSED"