gzseek()/gztell() read uninitialized state->past in write mode, silently corrupting output (since a4e4521)

[jxravi]

Summary

gz_reset() initializes state->past only inside the state->mode == GZ_READ
branch, but since commit
a4e4521
gzseek64() and gztell64() read it in either mode. gz_open() allocates
gz_state with a plain malloc() and does not zero it, so a write-mode handle reads
past out of indeterminate heap.

Two consequences, both write-mode only:

1. Silent output corruption. Two SEEK_CUR seeks with no write between them can
   drop the accumulated zero-fill, producing a well-formed gzip stream with a valid
   CRC and the wrong contents.
2. gztell() returns the wrong position after a deferred seek, breaking the
   documented gztell(file) == gzseek(file, 0L, SEEK_CUR) equivalence in zlib.h.

Affected: v1.3.1.2, v1.3.2, master, develop — all reproduced below.
v1.3.1 and earlier are unaffected. Still present on develop.

Root cause

gzlib.c, gz_reset():

local void gz_reset(gz_statep state) {
    state->x.have = 0;              /* no output data available */
    if (state->mode == GZ_READ) {   /* for reading ... */
        state->eof = 0;             /* not at end of file */
        state->past = 0;            /* <-- only initialized for reading */
        state->how = LOOK;
        state->junk = -1;
    }
    else                            /* for writing ... */
        state->reset = 0;
    state->again = 0;
    state->skip = 0;                /* no seek request pending */
    ...
}

The two write-mode readers, both added by a4e4521:

/* gzseek64() */
else {
    offset += state->past ? 0 : state->skip;
    state->skip = 0;
}

/* gztell64() */
return state->x.pos + (state->past ? 0 : state->skip);

[jxravi]

How the corruption happens

gzseek64() defers a seek by storing the amount in state->skip; a later gz_zero()
emits that many zero bytes and clears it. A second SEEK_CUR seek arriving before any
write must fold the pending skip into the new offset — that is what
offset += state->past ? 0 : state->skip does.

In write mode gz_zero() always drains skip on success and nothing ever assigns
past, so the correct value of past is always 0 and the fold should always happen.
When the indeterminate byte is nonzero the fold is skipped and the accumulated
zero-fill is lost from the output.

A single seek is unaffected: skip is still 0 on entry, so the fold is a no-op either
way and gz_zero() writes the full fill on the next write. SEEK_SET is immune
because that branch never reads past.

Where it came from

a4e4521 — "Have gz_skip() update how far it got for later continuation. This also
simplifies seek processing in general." (2025-02-21, first released in v1.3.1.2).

Before it, the deferred-seek state was a separate int seek flag initialized
unconditionally in gz_reset():

    state->seek = 0;                /* no seek request pending */
...
    else if (state->seek)
        offset += state->skip;
    state->seek = 0;
...
    return state->x.pos + (state->seek ? state->skip : 0);

Dropping seek in favour of past is sound in principle — skip == 0 already
encodes "no seek pending" — but past has strictly narrower initialization than the
field it replaced, and gz_reset() was not widened to match.

Until then the only reader of past was gzeof():

return state->mode == GZ_READ ? state->past : 0;

which short-circuits before touching it in write mode, so the narrow initialization
had been harmless since it was introduced.

[jxravi]

Reproducer

The essential case:

gzFile w = gzopen("t.gz", "wb");
gzwrite(w, "HEAD", 4);
gzseek(w, 100, SEEK_CUR);   /* deferred: skip = 100          */
gzseek(w,  50, SEEK_CUR);   /* skip nonzero on entry -> past */
gzwrite(w, "TAIL", 4);
gzclose(w);
/* expect 158 bytes with 150 zero-fill; buggy runs give 58 with 50 */

Because the outcome depends on what the allocator returns, run it in a loop or prime
the heap first so malloc() hands back dirty memory:

static void prime_heap(void) {
    enum { NBLK = 512 };
    void *blk[NBLK];
    for (size_t sz = 64; sz <= 1024; sz += 32) {
        for (size_t i = 0; i < NBLK; i++) {
            blk[i] = malloc(sz);
            if (blk[i]) memset(blk[i], 0xAA, sz);
        }
        for (size_t i = 0; i < NBLK; i++) free(blk[i]);
    }
}