Update vendored zlib to 1.4 by bmehta001 · Pull Request #1558 · microsoft/cpp_client_telemetry

bmehta001 · 2026-11-05T22:45:50Z

Summary

Update the vendored zlib sources and bundled minizip files from 1.3.2 to the latest upstream release, 1.4, including its security and correctness fixes.
Record upstream commit 99623ef7097352da7993ba614161fd6a311e046e in cgmanifest.json.
Preserve the SDK's act_z_ symbol isolation and legacy Windows/CMake library names. Synchronize the CMake header template with 1.4's Windows large-file support, fix prefixed large-file macro redefinitions, populate pkg-config metadata, and run the existing 64-bit-offset examples on Windows too.

vcpkg behavior

The SDK's vcpkg recipes already select an external zlib package rather than the vendored copy (Apple uses the OS library). The public vcpkg registry currently provides zlib 1.3.2#3, so this PR cannot update that dependency just by replacing the SDK's sources. vcpkg needs its own zlib port update to 1.4; consumers then need a registry checkout/baseline that includes that update. Existing pinned baselines do not advance automatically. No unrelated registry PR or custom overlay is introduced here.

Validation

Windows x64, Visual Studio 2026: SDK build and all 29 selected compression, HTTP encoding/decoding, payload decoding, and zlib utility tests passed.
Linux x64, Ubuntu/WSL with GCC 13: SDK build and the same 29 selected tests passed.
Standalone zlib: both normal and 64-bit-offset example tests passed on Windows and Linux; Windows 64-bit static consumer also compiled under /W4 /WX and ran successfully.
Linux static-library symbol inspection: every defined global symbol retains the SDK's act_z_ prefix.
vcpkg native and registry feature contracts, package dependency contracts, and all 13 release-port tests passed. These are recipe contract checks, not a full vcpkg package installation.
Existing repository spellcheck lint and git diff --check passed.

Only targeted SDK suites were run; no selected tests were skipped. Existing unrelated GoogleTest CMake deprecations, MSVC warning-level override notices, and SQLite macro redefinition warnings remain. The standalone zlib build was also exercised without the SDK's third-party warning suppression.

CI runner compatibility

Replace the retired macos-14 iOS matrix lane with supported macos-26 and its installed iPhone 17 / iPad Pro 11-inch (M5) simulators. Keep the macos-15 lane and all eight debug/release phone/tablet combinations. Existing iOS deployment targets remain unchanged.

Verified supported labels and simulator inventories against GitHub's runner reference and the macOS 26 image inventory. Parsed workflow YAML and validated all expanded matrix combinations locally on Windows and Linux; existing spellcheck lint and whitespace checks passed. Actual Xcode/simulator execution requires hosted CI.

Refresh the vendored dependency to upstream v1.4 to pick up its security and correctness fixes. Preserve the SDK symbol prefix and legacy build targets, align the CMake configuration with native Windows large-file support, and exercise 64-bit offset consumers on Windows. Files changed: cgmanifest.json zlib/CMakeLists.txt zlib/ChangeLog zlib/Makefile.in zlib/compress.c zlib/configure zlib/contrib/delphi/ZLib.pas zlib/contrib/dotzlib/DotZLib/UnitTests.cs zlib/contrib/infback9/inftree9.c zlib/contrib/minizip/CMakeLists.txt zlib/contrib/minizip/Makefile.am zlib/contrib/minizip/configure.ac zlib/contrib/minizip/crypt.h zlib/contrib/minizip/ioapi.h zlib/contrib/minizip/miniunz.c zlib/contrib/minizip/minizipConfig.cmake.in zlib/contrib/minizip/mztools.c zlib/contrib/minizip/skipset.h zlib/contrib/minizip/test/CMakeLists.txt zlib/contrib/minizip/test/add_subdirectory_exclude_test.cmake.in zlib/contrib/minizip/test/add_subdirectory_test.cmake.in zlib/contrib/minizip/test/find_package_no_components_test.cmake.in zlib/contrib/minizip/test/find_package_test.cmake.in zlib/contrib/minizip/test/find_package_wrong_components_test.cmake.in zlib/contrib/minizip/unzip.c zlib/contrib/minizip/unzip.h zlib/contrib/minizip/zip.c zlib/contrib/minizip/zip.h zlib/contrib/pascal/zlibpas.pas zlib/crc32.c zlib/deflate.c zlib/gzguts.h zlib/gzlib.c zlib/gzread.c zlib/gzwrite.c zlib/infback.c zlib/inflate.c zlib/inflate.h zlib/inftrees.c zlib/inftrees.h zlib/qnx/package.qpg zlib/test/infcover.c zlib/test/minigzip.c zlib/treebuild.xml zlib/trees.c zlib/uncompr.c zlib/win32/Makefile.msc zlib/win32/README-WIN32.txt zlib/zconf.h zlib/zconf.h.cmakein zlib/zconf.h.in zlib/zlib.3 zlib/zlib.3.pdf zlib/zlib.h zlib/zlib.pc.cmakein zlib/zutil.c Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 75db4712-f7f2-445b-bb95-9881e4c13228

Use supported macos-26 runners and their installed iPhone 17 and iPad Pro 11-inch (M5) simulators. Preserve the macos-15 jobs, all eight debug/release phone/tablet combinations, and the existing iOS deployment targets. Files changed: .github/workflows/build-ios-mac.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 75db4712-f7f2-445b-bb95-9881e4c13228

Integrate the concurrent main-branch merge without rewriting either commit history. The merge introduces no additional manual file edits. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 75db4712-f7f2-445b-bb95-9881e4c13228

Use Google's Maven Central mirror before the shared rate-limited endpoint while preserving full Java builds and CodeQL analysis. Prepare a distinct SwiftPM-compatible release version and pin the default Swift binary to the latest published artifact. Files: lib/android_build/build.gradle, lib/include/public/Version.hpp, Package.swift Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7aef1c72-9845-4155-bc0c-969d69703c6e

Copilot

🟡 Changes recommended

A partial transparent read followed by EIO can leave a stale buffer pointer, allowing subsequent reads to access memory beyond the allocation.

4 open issues

What changed in this PR

Updates the SDK’s vendored zlib to 1.4, bringing upstream security and correctness fixes while retaining SDK-specific symbol isolation and legacy library names. External vcpkg dependencies remain unchanged.

Changes:

Refresh zlib and minizip sources, documentation, version metadata, and upstream provenance.
Update Windows large-file support, packaging metadata, and standalone build/test integration.
Refresh iOS CI runners, add an Android dependency mirror, and advance SDK/Swift package version references.

File	Description
`zlib/zutil.c`	Fix allocation cleanup.
`zlib/zlib.pc.cmakein`	Populate configured installation paths.
`zlib/zlib.h`	Update version, API documentation, and large-file aliases.
`zlib/zlib.3`	Update manual release information.
`zlib/zconf.h.in`	Update offset types and Windows large-file support.
`zlib/zconf.h.cmakein`	Synchronize CMake-generated offset definitions.
`zlib/zconf.h`	Update bundled offset definitions.
`zlib/win32/README-WIN32.txt`	Update Windows release references.
`zlib/win32/Makefile.msc`	Remove the fixed DLL base address.
`zlib/uncompr.c`	Use portable null-pointer macros.
`zlib/trees.c`	Bound character classification input.
`zlib/treebuild.xml`	Update package version metadata.
`zlib/test/minigzip.c`	Improve memory-mapping portability.
`zlib/test/infcover.c`	Extend invalid-dictionary coverage and allocation handling.
`zlib/qnx/package.qpg`	Update QNX library version references.
`zlib/Makefile.in`	Update version and AIX export generation.
`zlib/inftrees.h`	Adjust workaround decoding-table limits.
`zlib/inftrees.c`	Update version and invalid-code entries.
`zlib/inflate.h`	Track requested window and wrapper settings.
`zlib/inflate.c`	Fix reset, synchronization, dictionary, and copy handling.
`zlib/infback.c`	Correct fast-path window bookkeeping.
`zlib/gzwrite.c`	Fix buffering, zero-fill, and stalled-write handling.
`zlib/gzread.c`	Revise buffered errors, skipping, and stream-end handling.
`zlib/gzlib.c`	Harden file opening, seeking, and error state.
`zlib/gzguts.h`	Add portable blocking checks and offset limits.
`zlib/deflate.c`	Fix reset, priming, copying, and block completion.
`zlib/crc32.c`	Explicitly cast the initial braid checksum.
`zlib/contrib/pascal/zlibpas.pas`	Update Pascal version constants.
`zlib/contrib/minizip/zip.h`	Document extra-field size limits.
`zlib/contrib/minizip/zip.c`	Harden ZIP64 metadata, parsing, and cleanup.
`zlib/contrib/minizip/unzip.h`	Clarify truncated-string handling.
`zlib/contrib/minizip/unzip.c`	Validate ZIP64 locations and extra-field boundaries.
`zlib/contrib/minizip/test/find_package_wrong_components_test.cmake.in`	Raise the test’s CMake minimum.
`zlib/contrib/minizip/test/find_package_test.cmake.in`	Update CMake minimum and format component requests.
`zlib/contrib/minizip/test/find_package_no_components_test.cmake.in`	Raise the test’s CMake minimum.
`zlib/contrib/minizip/test/CMakeLists.txt`	Revise package-test paths, fixtures, and platform options.
`zlib/contrib/minizip/test/add_subdirectory_test.cmake.in`	Raise the test’s CMake minimum.
`zlib/contrib/minizip/test/add_subdirectory_exclude_test.cmake.in`	Raise the test’s CMake minimum.
`zlib/contrib/minizip/skipset.h`	Localize helpers and improve C compatibility.
`zlib/contrib/minizip/mztools.c`	Use unsigned arithmetic for 32-bit reads.
`zlib/contrib/minizip/minizipConfig.cmake.in`	Improve dependency and component reporting.
`zlib/contrib/minizip/miniunz.c`	Sanitize extraction paths and revise directory creation.
`zlib/contrib/minizip/Makefile.am`	Install integer definitions and link miniunzip with zlib.
`zlib/contrib/minizip/ioapi.h`	Correct Android large-file feature detection.
`zlib/contrib/minizip/crypt.h`	Switch encryption-header generation to PCG32.
`zlib/contrib/minizip/configure.ac`	Update the Autoconf package version.
`zlib/contrib/minizip/CMakeLists.txt`	Revise targets, installation metadata, and test setup.
`zlib/contrib/infback9/inftree9.c`	Remove out-of-bounds table-pointer arithmetic.
`zlib/contrib/dotzlib/DotZLib/UnitTests.cs`	Update the expected zlib version.
`zlib/contrib/delphi/ZLib.pas`	Update the Delphi version constant.
`zlib/configure`	Improve generated-header and platform linker handling.
`zlib/compress.c`	Use portable null-pointer macros.
`zlib/CMakeLists.txt`	Update version, pkg-config paths, and Windows examples.
`zlib/ChangeLog`	Record upstream 1.4 changes.
`Package.swift`	Update the binary release URL and checksum.
`lib/include/public/Version.hpp`	Advance the SDK build version.
`lib/android_build/build.gradle`	Add a Maven Central mirror before the primary repository.
`cgmanifest.json`	Record the zlib 1.4 upstream commit.
`.github/workflows/build-ios-mac.yml`	Replace the macOS 14 lane and its simulators.

_{Review effort: Balanced}

bmehta001 · 2026-11-06T05:58:57Z

These zlib comments CoPilot made are perhaps accurate, but I would prefer to copy the library as is rather than making my own modifications, so I am resolving them.

Baiju Meswani (baijumeswani)

I would hold approval until the read error-path and minizip packaging issues below are addressed. All 29 targeted SDK tests passed locally, but they do not cover these cases. The sanitizer reproduction was inconclusive.

Baiju Meswani (baijumeswani) · 2026-11-06T07:58:07Z

+    /* after a serious error, only what is already in the output buffer is
+       delivered -- don't try to decompress any more */
+    if (state->err != Z_OK && state->err != Z_BUF_ERROR && !state->again)
+        return -1;


Please reset state->x.next to state->out before calling gz_load(). If the read returns some bytes and then fails, this early return leaves the pointer at the end of the old buffer. The next read can then copy from outside the buffer. Please add a test for a partial read followed by an I/O error.

Baiju Meswani (baijumeswani) · 2026-11-06T07:58:07Z

    zip.h)

+set(LIBMINIZIP_PC ${minizip_BINARY_DIR}/minizip.pc)
+configure_file(${minizip_SOURCE_DIR}/minizip.pc.txt ${LIBMINIZIP_PC} @ONLY)


Please fix the link order in minizip.pc.txt before installing it. It currently lists -lz -lminizip, which can leave unresolved zlib symbols when linking static libraries. Put minizip first and list zlib in Libs.private; include bzip2 there too when enabled.

Baiju Meswani (baijumeswani) · 2026-11-06T07:58:07Z

+    target_include_directories(${ZLIB_CONTRIB_PREFIX}libminizip
+        PUBLIC
+            $<BUILD_INTERFACE:${minizip_SOURCE_DIR}>
+            $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)


The headers are installed under include/minizip, but this target only adds include to the consumer's search path. Code using <zip.h> or <unzip.h> can build here but fail after installation. Please expose the installed minizip header directory for both the shared and static targets.

Baiju Meswani (baijumeswani) · 2026-11-06T07:58:07Z

+        set_target_properties(${ZLIB_CONTRIB_PREFIX}libminizip
+            PROPERTIES
+                SOVERSION ${zlib_VERSION_MAJOR}
+                VERSION ${INSTALL_VERSION})


These version variables are not defined when minizip is built on its own. With both values empty, CMake treats VERSION as the value of SOVERSION, producing the wrong shared-library name. Please use minizip_VERSION_MAJOR and minizip_VERSION here and check the installed library name.

bmehta001 requested a review from a team as a code owner November 5, 2026 22:45

bmehta001 mentioned this pull request Nov 5, 2026

Update vendored zlib to 1.4 bmehta001/cpp_client_telemetry#9

Closed

bmehta001 self-assigned this Nov 5, 2026

bmehta001 and others added 3 commits November 5, 2026 16:46

Merge branch 'main' into update-zlib-1.4

6430726

bmehta001 enabled auto-merge (squash) November 5, 2026 22:51

bmehta001 requested a balanced review from Copilot November 6, 2026 05:47

Copilot started reviewing on behalf of bmehta001 November 6, 2026 05:48

View session

Copilot AI reviewed Nov 6, 2026

View reviewed changes

Comment thread zlib/gzread.c Resolved

Comment thread zlib/contrib/minizip/CMakeLists.txt Resolved

Comment thread zlib/contrib/minizip/CMakeLists.txt Resolved

Comment thread zlib/contrib/minizip/CMakeLists.txt Resolved

Baiju Meswani (baijumeswani) reviewed Nov 6, 2026

View reviewed changes

Navigation Menu

Repository navigation

Update vendored zlib to 1.4 - #1558

Update vendored zlib to 1.4#1558
bmehta001 wants to merge 5 commits into
microsoft:mainfrom
bmehta001:update-zlib-1.4

bmehta001 commented Nov 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bmehta001 commented Nov 6, 2026 •

edited

Loading

Uh oh!

Baiju Meswani (baijumeswani) left a comment

Uh oh!

Baiju Meswani (baijumeswani) Nov 6, 2026

Uh oh!

Baiju Meswani (baijumeswani) Nov 6, 2026

Uh oh!

Baiju Meswani (baijumeswani) Nov 6, 2026

Uh oh!

Baiju Meswani (baijumeswani) Nov 6, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

bmehta001 commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

vcpkg behavior

Validation

CI runner compatibility

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bmehta001 commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Baiju Meswani (baijumeswani) left a comment

Choose a reason for hiding this comment

Uh oh!

Baiju Meswani (baijumeswani) Nov 6, 2026

Choose a reason for hiding this comment

Uh oh!

Baiju Meswani (baijumeswani) Nov 6, 2026

Choose a reason for hiding this comment

Uh oh!

Baiju Meswani (baijumeswani) Nov 6, 2026

Choose a reason for hiding this comment

Uh oh!

Baiju Meswani (baijumeswani) Nov 6, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bmehta001 commented Nov 5, 2026 •

edited

Loading

bmehta001 commented Nov 6, 2026 •

edited

Loading