Hacker News Reader

needs (Aug) btw.

Does this affect zlib-ng also?

Once I've looked into zlib code a few years ago, I abandoned it. It's a mess, only comparable to openssl, sqlite and bash.

View on HN

Zlib-ng doesn't contain the same code, but it appears that their equivalent inflate() when used with their inflateGetHeader() implementation was affected by a similar problem: https://github.com/zlib-ng/zlib-ng/pull/1328

Also similarly, most client code will be unaffected because `state->head` will be NULL, because they (most client code) won't have used inflateGetHeader() at all.

> It's a mess, only comparable to openssl, sqlite and bash.

Why do you consider sqlite abandoned or a mess?

because is almost impossible to fix, harden or make secure. it's not just the broken overall architecture, which eg enables write on read, also it's internal code. eg the various attempts to get FTS. it's worse than openssl, which gets all the FLAC

> because is almost impossible to fix, harden or make secure.

I'd like some more context on this. Especially since it is used in many security-critical contexts currently.

https://github.com/rurban/hardsqlite

I gave up on it

Reply on news.ycombinator.com