Hacker News Reader

Comment by binaryturtle | Hacker News Reader

It should mention the bug only exists after some arbitrary "patch" was introduced. As the current title makes it sounds like the actual zlib has a security issue.

View on HN

Seems like it's not just arbitrary, but crafted. Could not find it anywhere, for example, searching for "DISTS so we can remove overflow checks from" (with quotes ofc) brings up just this site, both in Google and Bing. It has typos, btw. It would be another issue if it came from https://chromium.googlesource.com/chromium/src/+/HEAD/third_..., but that's not the case.

Crafted for the Google CTF. Here's the challenge:

https://capturetheflag.withgoogle.com/challenges/pwn-webz

There's an attachment link, which I believe contains the patch (I haven't looked though):

https://storage.googleapis.com/2025-attachments/193040ef9e60...

The original title included "[CTF] Google CTF 2025" which would strongly hint(CTF=capture the flag) at the possibility of an artificial setting. That probably should of been included in the submission.

Many CTF challenges use existing real vulnerabilities, so that alone may not be sufficient.

Yes, which is why you can look at the article to figure out if it is real or not.

Not the author. The first sentence of the article does say this “webz is a zlib exploitation challenge from Google CTF 2025. The Google-zlib implementation provided in the challenge is not upstream; it’s a version with an arbitrary patch applied.”

It’s almost quite literally your comment word for word.

Reply on news.ycombinator.com