1
2 Frequently Asked Questions about zlib
3
4
5If your question is not there, please check the zlib home page
6http://zlib.net/ which may have more recent information.
7The lastest zlib FAQ is at http://zlib.net/zlib_faq.html
8
9
10 1. Is zlib Y2K-compliant?
11
12 Yes. zlib doesn't handle dates.
13
14 2. Where can I get a Windows DLL version?
15
16 The zlib sources can be compiled without change to produce a DLL. See the
17 file win32/DLL_FAQ.txt in the zlib distribution. Pointers to the
18 precompiled DLL are found in the zlib web site at http://zlib.net/ .
19
20 3. Where can I get a Visual Basic interface to zlib?
21
22 See
23 * http://marknelson.us/1997/01/01/zlib-engine/
24 * win32/DLL_FAQ.txt in the zlib distribution
25
26 4. compress() returns Z_BUF_ERROR.
27
28 Make sure that before the call of compress(), the length of the compressed
29 buffer is equal to the available size of the compressed buffer and not
30 zero. For Visual Basic, check that this parameter is passed by reference
31 ("as any"), not by value ("as long").
32
33 5. deflate() or inflate() returns Z_BUF_ERROR.
34
35 Before making the call, make sure that avail_in and avail_out are not zero.
36 When setting the parameter flush equal to Z_FINISH, also make sure that
37 avail_out is big enough to allow processing all pending input. Note that a
38 Z_BUF_ERROR is not fatal--another call to deflate() or inflate() can be
39 made with more input or output space. A Z_BUF_ERROR may in fact be
40 unavoidable depending on how the functions are used, since it is not
41 possible to tell whether or not there is more output pending when
42 strm.avail_out returns with zero. See http://zlib.net/zlib_how.html for a
43 heavily annotated example.
44
45 6. Where's the zlib documentation (man pages, etc.)?
46
47 It's in zlib.h . Examples of zlib usage are in the files test/example.c
48 and test/minigzip.c, with more in examples/ .
49
50 7. Why don't you use GNU autoconf or libtool or ...?
51
52 Because we would like to keep zlib as a very small and simple package.
53 zlib is rather portable and doesn't need much configuration.
54
55 8. I found a bug in zlib.
56
57 Most of the time, such problems are due to an incorrect usage of zlib.
58 Please try to reproduce the problem with a small program and send the
59 corresponding source to us at zlib@gzip.org . Do not send multi-megabyte
60 data files without prior agreement.
61
62 9. Why do I get "undefined reference to gzputc"?
63
64 If "make test" produces something like
65
66 example.o(.text+0x154): undefined reference to `gzputc'
67
68 check that you don't have old files libz.* in /usr/lib, /usr/local/lib or
69 /usr/X11R6/lib. Remove any old versions, then do "make install".
70
7110. I need a Delphi interface to zlib.
72
73 See the contrib/delphi directory in the zlib distribution.
74
7511. Can zlib handle .zip archives?
76
77 Not by itself, no. See the directory contrib/minizip in the zlib
78 distribution.
79
8012. Can zlib handle .Z files?
81
82 No, sorry. You have to spawn an uncompress or gunzip subprocess, or adapt
83 the code of uncompress on your own.
84
8513. How can I make a Unix shared library?
86
87 By default a shared (and a static) library is built for Unix. So:
88
89 make distclean
90 ./configure
91 make
92
9314. How do I install a shared zlib library on Unix?
94
95 After the above, then:
96
97 make install
98
99 However, many flavors of Unix come with a shared zlib already installed.
100 Before going to the trouble of compiling a shared version of zlib and
101 trying to install it, you may want to check if it's already there! If you
102 can #include <zlib.h>, it's there. The -lz option will probably link to
103 it. You can check the version at the top of zlib.h or with the
104 ZLIB_VERSION symbol defined in zlib.h .
105
10615. I have a question about OttoPDF.
107
108 We are not the authors of OttoPDF. The real author is on the OttoPDF web
109 site: Joel Hainley, jhainley@myndkryme.com.
110
11116. Can zlib decode Flate data in an Adobe PDF file?
112
113 Yes. See http://www.pdflib.com/ . To modify PDF forms, see
114 http://sourceforge.net/projects/acroformtool/ .
115
11617. Why am I getting this "register_frame_info not found" error on Solaris?
117
118 After installing zlib 1.1.4 on Solaris 2.6, running applications using zlib
119 generates an error such as:
120
121 ld.so.1: rpm: fatal: relocation error: file /usr/local/lib/libz.so:
122 symbol __register_frame_info: referenced symbol not found
123
124 The symbol __register_frame_info is not part of zlib, it is generated by
125 the C compiler (cc or gcc). You must recompile applications using zlib
126 which have this problem. This problem is specific to Solaris. See
127 http://www.sunfreeware.com for Solaris versions of zlib and applications
128 using zlib.
129
13018. Why does gzip give an error on a file I make with compress/deflate?
131
132 The compress and deflate functions produce data in the zlib format, which
133 is different and incompatible with the gzip format. The gz* functions in
134 zlib on the other hand use the gzip format. Both the zlib and gzip formats
135 use the same compressed data format internally, but have different headers
136 and trailers around the compressed data.
137
13819. Ok, so why are there two different formats?
139
140 The gzip format was designed to retain the directory information about a
141 single file, such as the name and last modification date. The zlib format
142 on the other hand was designed for in-memory and communication channel
143 applications, and has a much more compact header and trailer and uses a
144 faster integrity check than gzip.
145
14620. Well that's nice, but how do I make a gzip file in memory?
147
148 You can request that deflate write the gzip format instead of the zlib
149 format using deflateInit2(). You can also request that inflate decode the
150 gzip format using inflateInit2(). Read zlib.h for more details.
151
15221. Is zlib thread-safe?
153
154 Yes. However any library routines that zlib uses and any application-
155 provided memory allocation routines must also be thread-safe. zlib's gz*
156 functions use stdio library routines, and most of zlib's functions use the
157 library memory allocation routines by default. zlib's *Init* functions
158 allow for the application to provide custom memory allocation routines.
159
160 Of course, you should only operate on any given zlib or gzip stream from a
161 single thread at a time.
162
16322. Can I use zlib in my commercial application?
164
165 Yes. Please read the license in zlib.h.
166
16723. Is zlib under the GNU license?
168
169 No. Please read the license in zlib.h.
170
17124. The license says that altered source versions must be "plainly marked". So
172 what exactly do I need to do to meet that requirement?
173
174 You need to change the ZLIB_VERSION and ZLIB_VERNUM #defines in zlib.h. In
175 particular, the final version number needs to be changed to "f", and an
176 identification string should be appended to ZLIB_VERSION. Version numbers
177 x.x.x.f are reserved for modifications to zlib by others than the zlib
178 maintainers. For example, if the version of the base zlib you are altering
179 is "1.2.3.4", then in zlib.h you should change ZLIB_VERNUM to 0x123f, and
180 ZLIB_VERSION to something like "1.2.3.f-zachary-mods-v3". You can also
181 update the version strings in deflate.c and inftrees.c.
182
183 For altered source distributions, you should also note the origin and
184 nature of the changes in zlib.h, as well as in ChangeLog and README, along
185 with the dates of the alterations. The origin should include at least your
186 name (or your company's name), and an email address to contact for help or
187 issues with the library.
188
189 Note that distributing a compiled zlib library along with zlib.h and
190 zconf.h is also a source distribution, and so you should change
191 ZLIB_VERSION and ZLIB_VERNUM and note the origin and nature of the changes
192 in zlib.h as you would for a full source distribution.
193
19425. Will zlib work on a big-endian or little-endian architecture, and can I
195 exchange compressed data between them?
196
197 Yes and yes.
198
19926. Will zlib work on a 64-bit machine?
200
201 Yes. It has been tested on 64-bit machines, and has no dependence on any
202 data types being limited to 32-bits in length. If you have any
203 difficulties, please provide a complete problem report to zlib@gzip.org
204
20527. Will zlib decompress data from the PKWare Data Compression Library?
206
207 No. The PKWare DCL uses a completely different compressed data format than
208 does PKZIP and zlib. However, you can look in zlib's contrib/blast
209 directory for a possible solution to your problem.
210
21128. Can I access data randomly in a compressed stream?
212
213 No, not without some preparation. If when compressing you periodically use
214 Z_FULL_FLUSH, carefully write all the pending data at those points, and
215 keep an index of those locations, then you can start decompression at those
216 points. You have to be careful to not use Z_FULL_FLUSH too often, since it
217 can significantly degrade compression. Alternatively, you can scan a
218 deflate stream once to generate an index, and then use that index for
219 random access. See examples/zran.c .
220
22129. Does zlib work on MVS, OS/390, CICS, etc.?
222
223 It has in the past, but we have not heard of any recent evidence. There
224 were working ports of zlib 1.1.4 to MVS, but those links no longer work.
225 If you know of recent, successful applications of zlib on these operating
226 systems, please let us know. Thanks.
227
22830. Is there some simpler, easier to read version of inflate I can look at to
229 understand the deflate format?
230
231 First off, you should read RFC 1951. Second, yes. Look in zlib's
232 contrib/puff directory.
233
23431. Does zlib infringe on any patents?
235
236 As far as we know, no. In fact, that was originally the whole point behind
237 zlib. Look here for some more information:
238
239 http://www.gzip.org/#faq11
240
24132. Can zlib work with greater than 4 GB of data?
242
243 Yes. inflate() and deflate() will process any amount of data correctly.
244 Each call of inflate() or deflate() is limited to input and output chunks
245 of the maximum value that can be stored in the compiler's "unsigned int"
246 type, but there is no limit to the number of chunks. Note however that the
247 strm.total_in and strm_total_out counters may be limited to 4 GB. These
248 counters are provided as a convenience and are not used internally by
249 inflate() or deflate(). The application can easily set up its own counters
250 updated after each call of inflate() or deflate() to count beyond 4 GB.
251 compress() and uncompress() may be limited to 4 GB, since they operate in a
252 single call. gzseek() and gztell() may be limited to 4 GB depending on how
253 zlib is compiled. See the zlibCompileFlags() function in zlib.h.
254
255 The word "may" appears several times above since there is a 4 GB limit only
256 if the compiler's "long" type is 32 bits. If the compiler's "long" type is
257 64 bits, then the limit is 16 exabytes.
258
25933. Does zlib have any security vulnerabilities?
260
261 The only one that we are aware of is potentially in gzprintf(). If zlib is
262 compiled to use sprintf() or vsprintf(), then there is no protection
263 against a buffer overflow of an 8K string space (or other value as set by
264 gzbuffer()), other than the caller of gzprintf() assuring that the output
265 will not exceed 8K. On the other hand, if zlib is compiled to use
266 snprintf() or vsnprintf(), which should normally be the case, then there is
267 no vulnerability. The ./configure script will display warnings if an
268 insecure variation of sprintf() will be used by gzprintf(). Also the
269 zlibCompileFlags() function will return information on what variant of
270 sprintf() is used by gzprintf().
271
272 If you don't have snprintf() or vsnprintf() and would like one, you can
273 find a portable implementation here:
274
275 http://www.ijs.si/software/snprintf/
276
277 Note that you should be using the most recent version of zlib. Versions
278 1.1.3 and before were subject to a double-free vulnerability, and versions
279 1.2.1 and 1.2.2 were subject to an access exception when decompressing
280 invalid compressed data.
281
28234. Is there a Java version of zlib?
283
284 Probably what you want is to use zlib in Java. zlib is already included
285 as part of the Java SDK in the java.util.zip package. If you really want
286 a version of zlib written in the Java language, look on the zlib home
287 page for links: http://zlib.net/ .
288
28935. I get this or that compiler or source-code scanner warning when I crank it
290 up to maximally-pedantic. Can't you guys write proper code?
291
292 Many years ago, we gave up attempting to avoid warnings on every compiler
293 in the universe. It just got to be a waste of time, and some compilers
294 were downright silly as well as contradicted each other. So now, we simply
295 make sure that the code always works.
296
29736. Valgrind (or some similar memory access checker) says that deflate is
298 performing a conditional jump that depends on an uninitialized value.
299 Isn't that a bug?
300
301 No. That is intentional for performance reasons, and the output of deflate
302 is not affected. This only started showing up recently since zlib 1.2.x
303 uses malloc() by default for allocations, whereas earlier versions used
304 calloc(), which zeros out the allocated memory. Even though the code was
305 correct, versions 1.2.4 and later was changed to not stimulate these
306 checkers.
307
30837. Will zlib read the (insert any ancient or arcane format here) compressed
309 data format?
310
311 Probably not. Look in the comp.compression FAQ for pointers to various
312 formats and associated software.
313
31438. How can I encrypt/decrypt zip files with zlib?
315
316 zlib doesn't support encryption. The original PKZIP encryption is very
317 weak and can be broken with freely available programs. To get strong
318 encryption, use GnuPG, http://www.gnupg.org/ , which already includes zlib
319 compression. For PKZIP compatible "encryption", look at
320 http://www.info-zip.org/
321
32239. What's the difference between the "gzip" and "deflate" HTTP 1.1 encodings?
323
324 "gzip" is the gzip format, and "deflate" is the zlib format. They should
325 probably have called the second one "zlib" instead to avoid confusion with
326 the raw deflate compressed data format. While the HTTP 1.1 RFC 2616
327 correctly points to the zlib specification in RFC 1950 for the "deflate"
328 transfer encoding, there have been reports of servers and browsers that
329 incorrectly produce or expect raw deflate data per the deflate
330 specification in RFC 1951, most notably Microsoft. So even though the
331 "deflate" transfer encoding using the zlib format would be the more
332 efficient approach (and in fact exactly what the zlib format was designed
333 for), using the "gzip" transfer encoding is probably more reliable due to
334 an unfortunate choice of name on the part of the HTTP 1.1 authors.
335
336 Bottom line: use the gzip format for HTTP 1.1 encoding.
337
33840. Does zlib support the new "Deflate64" format introduced by PKWare?
339
340 No. PKWare has apparently decided to keep that format proprietary, since
341 they have not documented it as they have previous compression formats. In
342 any case, the compression improvements are so modest compared to other more
343 modern approaches, that it's not worth the effort to implement.
344
34541. I'm having a problem with the zip functions in zlib, can you help?
346
347 There are no zip functions in zlib. You are probably using minizip by
348 Giles Vollant, which is found in the contrib directory of zlib. It is not
349 part of zlib. In fact none of the stuff in contrib is part of zlib. The
350 files in there are not supported by the zlib authors. You need to contact
351 the authors of the respective contribution for help.
352
35342. The match.asm code in contrib is under the GNU General Public License.
354 Since it's part of zlib, doesn't that mean that all of zlib falls under the
355 GNU GPL?
356
357 No. The files in contrib are not part of zlib. They were contributed by
358 other authors and are provided as a convenience to the user within the zlib
359 distribution. Each item in contrib has its own license.
360
36143. Is zlib subject to export controls? What is its ECCN?
362
363 zlib is not subject to export controls, and so is classified as EAR99.
364
36544. Can you please sign these lengthy legal documents and fax them back to us
366 so that we can use your software in our product?
367
368 No. Go away. Shoo.
2 Frequently Asked Questions about zlib
3
4
5If your question is not there, please check the zlib home page
6http://zlib.net/ which may have more recent information.
7The lastest zlib FAQ is at http://zlib.net/zlib_faq.html
8
9
10 1. Is zlib Y2K-compliant?
11
12 Yes. zlib doesn't handle dates.
13
14 2. Where can I get a Windows DLL version?
15
16 The zlib sources can be compiled without change to produce a DLL. See the
17 file win32/DLL_FAQ.txt in the zlib distribution. Pointers to the
18 precompiled DLL are found in the zlib web site at http://zlib.net/ .
19
20 3. Where can I get a Visual Basic interface to zlib?
21
22 See
23 * http://marknelson.us/1997/01/01/zlib-engine/
24 * win32/DLL_FAQ.txt in the zlib distribution
25
26 4. compress() returns Z_BUF_ERROR.
27
28 Make sure that before the call of compress(), the length of the compressed
29 buffer is equal to the available size of the compressed buffer and not
30 zero. For Visual Basic, check that this parameter is passed by reference
31 ("as any"), not by value ("as long").
32
33 5. deflate() or inflate() returns Z_BUF_ERROR.
34
35 Before making the call, make sure that avail_in and avail_out are not zero.
36 When setting the parameter flush equal to Z_FINISH, also make sure that
37 avail_out is big enough to allow processing all pending input. Note that a
38 Z_BUF_ERROR is not fatal--another call to deflate() or inflate() can be
39 made with more input or output space. A Z_BUF_ERROR may in fact be
40 unavoidable depending on how the functions are used, since it is not
41 possible to tell whether or not there is more output pending when
42 strm.avail_out returns with zero. See http://zlib.net/zlib_how.html for a
43 heavily annotated example.
44
45 6. Where's the zlib documentation (man pages, etc.)?
46
47 It's in zlib.h . Examples of zlib usage are in the files test/example.c
48 and test/minigzip.c, with more in examples/ .
49
50 7. Why don't you use GNU autoconf or libtool or ...?
51
52 Because we would like to keep zlib as a very small and simple package.
53 zlib is rather portable and doesn't need much configuration.
54
55 8. I found a bug in zlib.
56
57 Most of the time, such problems are due to an incorrect usage of zlib.
58 Please try to reproduce the problem with a small program and send the
59 corresponding source to us at zlib@gzip.org . Do not send multi-megabyte
60 data files without prior agreement.
61
62 9. Why do I get "undefined reference to gzputc"?
63
64 If "make test" produces something like
65
66 example.o(.text+0x154): undefined reference to `gzputc'
67
68 check that you don't have old files libz.* in /usr/lib, /usr/local/lib or
69 /usr/X11R6/lib. Remove any old versions, then do "make install".
70
7110. I need a Delphi interface to zlib.
72
73 See the contrib/delphi directory in the zlib distribution.
74
7511. Can zlib handle .zip archives?
76
77 Not by itself, no. See the directory contrib/minizip in the zlib
78 distribution.
79
8012. Can zlib handle .Z files?
81
82 No, sorry. You have to spawn an uncompress or gunzip subprocess, or adapt
83 the code of uncompress on your own.
84
8513. How can I make a Unix shared library?
86
87 By default a shared (and a static) library is built for Unix. So:
88
89 make distclean
90 ./configure
91 make
92
9314. How do I install a shared zlib library on Unix?
94
95 After the above, then:
96
97 make install
98
99 However, many flavors of Unix come with a shared zlib already installed.
100 Before going to the trouble of compiling a shared version of zlib and
101 trying to install it, you may want to check if it's already there! If you
102 can #include <zlib.h>, it's there. The -lz option will probably link to
103 it. You can check the version at the top of zlib.h or with the
104 ZLIB_VERSION symbol defined in zlib.h .
105
10615. I have a question about OttoPDF.
107
108 We are not the authors of OttoPDF. The real author is on the OttoPDF web
109 site: Joel Hainley, jhainley@myndkryme.com.
110
11116. Can zlib decode Flate data in an Adobe PDF file?
112
113 Yes. See http://www.pdflib.com/ . To modify PDF forms, see
114 http://sourceforge.net/projects/acroformtool/ .
115
11617. Why am I getting this "register_frame_info not found" error on Solaris?
117
118 After installing zlib 1.1.4 on Solaris 2.6, running applications using zlib
119 generates an error such as:
120
121 ld.so.1: rpm: fatal: relocation error: file /usr/local/lib/libz.so:
122 symbol __register_frame_info: referenced symbol not found
123
124 The symbol __register_frame_info is not part of zlib, it is generated by
125 the C compiler (cc or gcc). You must recompile applications using zlib
126 which have this problem. This problem is specific to Solaris. See
127 http://www.sunfreeware.com for Solaris versions of zlib and applications
128 using zlib.
129
13018. Why does gzip give an error on a file I make with compress/deflate?
131
132 The compress and deflate functions produce data in the zlib format, which
133 is different and incompatible with the gzip format. The gz* functions in
134 zlib on the other hand use the gzip format. Both the zlib and gzip formats
135 use the same compressed data format internally, but have different headers
136 and trailers around the compressed data.
137
13819. Ok, so why are there two different formats?
139
140 The gzip format was designed to retain the directory information about a
141 single file, such as the name and last modification date. The zlib format
142 on the other hand was designed for in-memory and communication channel
143 applications, and has a much more compact header and trailer and uses a
144 faster integrity check than gzip.
145
14620. Well that's nice, but how do I make a gzip file in memory?
147
148 You can request that deflate write the gzip format instead of the zlib
149 format using deflateInit2(). You can also request that inflate decode the
150 gzip format using inflateInit2(). Read zlib.h for more details.
151
15221. Is zlib thread-safe?
153
154 Yes. However any library routines that zlib uses and any application-
155 provided memory allocation routines must also be thread-safe. zlib's gz*
156 functions use stdio library routines, and most of zlib's functions use the
157 library memory allocation routines by default. zlib's *Init* functions
158 allow for the application to provide custom memory allocation routines.
159
160 Of course, you should only operate on any given zlib or gzip stream from a
161 single thread at a time.
162
16322. Can I use zlib in my commercial application?
164
165 Yes. Please read the license in zlib.h.
166
16723. Is zlib under the GNU license?
168
169 No. Please read the license in zlib.h.
170
17124. The license says that altered source versions must be "plainly marked". So
172 what exactly do I need to do to meet that requirement?
173
174 You need to change the ZLIB_VERSION and ZLIB_VERNUM #defines in zlib.h. In
175 particular, the final version number needs to be changed to "f", and an
176 identification string should be appended to ZLIB_VERSION. Version numbers
177 x.x.x.f are reserved for modifications to zlib by others than the zlib
178 maintainers. For example, if the version of the base zlib you are altering
179 is "1.2.3.4", then in zlib.h you should change ZLIB_VERNUM to 0x123f, and
180 ZLIB_VERSION to something like "1.2.3.f-zachary-mods-v3". You can also
181 update the version strings in deflate.c and inftrees.c.
182
183 For altered source distributions, you should also note the origin and
184 nature of the changes in zlib.h, as well as in ChangeLog and README, along
185 with the dates of the alterations. The origin should include at least your
186 name (or your company's name), and an email address to contact for help or
187 issues with the library.
188
189 Note that distributing a compiled zlib library along with zlib.h and
190 zconf.h is also a source distribution, and so you should change
191 ZLIB_VERSION and ZLIB_VERNUM and note the origin and nature of the changes
192 in zlib.h as you would for a full source distribution.
193
19425. Will zlib work on a big-endian or little-endian architecture, and can I
195 exchange compressed data between them?
196
197 Yes and yes.
198
19926. Will zlib work on a 64-bit machine?
200
201 Yes. It has been tested on 64-bit machines, and has no dependence on any
202 data types being limited to 32-bits in length. If you have any
203 difficulties, please provide a complete problem report to zlib@gzip.org
204
20527. Will zlib decompress data from the PKWare Data Compression Library?
206
207 No. The PKWare DCL uses a completely different compressed data format than
208 does PKZIP and zlib. However, you can look in zlib's contrib/blast
209 directory for a possible solution to your problem.
210
21128. Can I access data randomly in a compressed stream?
212
213 No, not without some preparation. If when compressing you periodically use
214 Z_FULL_FLUSH, carefully write all the pending data at those points, and
215 keep an index of those locations, then you can start decompression at those
216 points. You have to be careful to not use Z_FULL_FLUSH too often, since it
217 can significantly degrade compression. Alternatively, you can scan a
218 deflate stream once to generate an index, and then use that index for
219 random access. See examples/zran.c .
220
22129. Does zlib work on MVS, OS/390, CICS, etc.?
222
223 It has in the past, but we have not heard of any recent evidence. There
224 were working ports of zlib 1.1.4 to MVS, but those links no longer work.
225 If you know of recent, successful applications of zlib on these operating
226 systems, please let us know. Thanks.
227
22830. Is there some simpler, easier to read version of inflate I can look at to
229 understand the deflate format?
230
231 First off, you should read RFC 1951. Second, yes. Look in zlib's
232 contrib/puff directory.
233
23431. Does zlib infringe on any patents?
235
236 As far as we know, no. In fact, that was originally the whole point behind
237 zlib. Look here for some more information:
238
239 http://www.gzip.org/#faq11
240
24132. Can zlib work with greater than 4 GB of data?
242
243 Yes. inflate() and deflate() will process any amount of data correctly.
244 Each call of inflate() or deflate() is limited to input and output chunks
245 of the maximum value that can be stored in the compiler's "unsigned int"
246 type, but there is no limit to the number of chunks. Note however that the
247 strm.total_in and strm_total_out counters may be limited to 4 GB. These
248 counters are provided as a convenience and are not used internally by
249 inflate() or deflate(). The application can easily set up its own counters
250 updated after each call of inflate() or deflate() to count beyond 4 GB.
251 compress() and uncompress() may be limited to 4 GB, since they operate in a
252 single call. gzseek() and gztell() may be limited to 4 GB depending on how
253 zlib is compiled. See the zlibCompileFlags() function in zlib.h.
254
255 The word "may" appears several times above since there is a 4 GB limit only
256 if the compiler's "long" type is 32 bits. If the compiler's "long" type is
257 64 bits, then the limit is 16 exabytes.
258
25933. Does zlib have any security vulnerabilities?
260
261 The only one that we are aware of is potentially in gzprintf(). If zlib is
262 compiled to use sprintf() or vsprintf(), then there is no protection
263 against a buffer overflow of an 8K string space (or other value as set by
264 gzbuffer()), other than the caller of gzprintf() assuring that the output
265 will not exceed 8K. On the other hand, if zlib is compiled to use
266 snprintf() or vsnprintf(), which should normally be the case, then there is
267 no vulnerability. The ./configure script will display warnings if an
268 insecure variation of sprintf() will be used by gzprintf(). Also the
269 zlibCompileFlags() function will return information on what variant of
270 sprintf() is used by gzprintf().
271
272 If you don't have snprintf() or vsnprintf() and would like one, you can
273 find a portable implementation here:
274
275 http://www.ijs.si/software/snprintf/
276
277 Note that you should be using the most recent version of zlib. Versions
278 1.1.3 and before were subject to a double-free vulnerability, and versions
279 1.2.1 and 1.2.2 were subject to an access exception when decompressing
280 invalid compressed data.
281
28234. Is there a Java version of zlib?
283
284 Probably what you want is to use zlib in Java. zlib is already included
285 as part of the Java SDK in the java.util.zip package. If you really want
286 a version of zlib written in the Java language, look on the zlib home
287 page for links: http://zlib.net/ .
288
28935. I get this or that compiler or source-code scanner warning when I crank it
290 up to maximally-pedantic. Can't you guys write proper code?
291
292 Many years ago, we gave up attempting to avoid warnings on every compiler
293 in the universe. It just got to be a waste of time, and some compilers
294 were downright silly as well as contradicted each other. So now, we simply
295 make sure that the code always works.
296
29736. Valgrind (or some similar memory access checker) says that deflate is
298 performing a conditional jump that depends on an uninitialized value.
299 Isn't that a bug?
300
301 No. That is intentional for performance reasons, and the output of deflate
302 is not affected. This only started showing up recently since zlib 1.2.x
303 uses malloc() by default for allocations, whereas earlier versions used
304 calloc(), which zeros out the allocated memory. Even though the code was
305 correct, versions 1.2.4 and later was changed to not stimulate these
306 checkers.
307
30837. Will zlib read the (insert any ancient or arcane format here) compressed
309 data format?
310
311 Probably not. Look in the comp.compression FAQ for pointers to various
312 formats and associated software.
313
31438. How can I encrypt/decrypt zip files with zlib?
315
316 zlib doesn't support encryption. The original PKZIP encryption is very
317 weak and can be broken with freely available programs. To get strong
318 encryption, use GnuPG, http://www.gnupg.org/ , which already includes zlib
319 compression. For PKZIP compatible "encryption", look at
320 http://www.info-zip.org/
321
32239. What's the difference between the "gzip" and "deflate" HTTP 1.1 encodings?
323
324 "gzip" is the gzip format, and "deflate" is the zlib format. They should
325 probably have called the second one "zlib" instead to avoid confusion with
326 the raw deflate compressed data format. While the HTTP 1.1 RFC 2616
327 correctly points to the zlib specification in RFC 1950 for the "deflate"
328 transfer encoding, there have been reports of servers and browsers that
329 incorrectly produce or expect raw deflate data per the deflate
330 specification in RFC 1951, most notably Microsoft. So even though the
331 "deflate" transfer encoding using the zlib format would be the more
332 efficient approach (and in fact exactly what the zlib format was designed
333 for), using the "gzip" transfer encoding is probably more reliable due to
334 an unfortunate choice of name on the part of the HTTP 1.1 authors.
335
336 Bottom line: use the gzip format for HTTP 1.1 encoding.
337
33840. Does zlib support the new "Deflate64" format introduced by PKWare?
339
340 No. PKWare has apparently decided to keep that format proprietary, since
341 they have not documented it as they have previous compression formats. In
342 any case, the compression improvements are so modest compared to other more
343 modern approaches, that it's not worth the effort to implement.
344
34541. I'm having a problem with the zip functions in zlib, can you help?
346
347 There are no zip functions in zlib. You are probably using minizip by
348 Giles Vollant, which is found in the contrib directory of zlib. It is not
349 part of zlib. In fact none of the stuff in contrib is part of zlib. The
350 files in there are not supported by the zlib authors. You need to contact
351 the authors of the respective contribution for help.
352
35342. The match.asm code in contrib is under the GNU General Public License.
354 Since it's part of zlib, doesn't that mean that all of zlib falls under the
355 GNU GPL?
356
357 No. The files in contrib are not part of zlib. They were contributed by
358 other authors and are provided as a convenience to the user within the zlib
359 distribution. Each item in contrib has its own license.
360
36143. Is zlib subject to export controls? What is its ECCN?
362
363 zlib is not subject to export controls, and so is classified as EAR99.
364
36544. Can you please sign these lengthy legal documents and fax them back to us
366 so that we can use your software in our product?
367
368 No. Go away. Shoo.