[bmehta001]

Summary

• Update the vendored zlib sources and bundled minizip files from 1.3.2 to the latest upstream release, 1.4, including its security and correctness fixes.
• Record upstream commit 99623ef7097352da7993ba614161fd6a311e046e in cgmanifest.json.
• Preserve the SDK's act_z_ symbol isolation and legacy Windows/CMake library names. Synchronize the CMake header template with 1.4's Windows large-file support, fix prefixed large-file macro redefinitions, populate pkg-config metadata, and run the existing 64-bit-offset examples on Windows too.

vcpkg behavior

The SDK's vcpkg recipes already select an external zlib package rather than the vendored copy (Apple uses the OS library). The public vcpkg registry currently provides zlib 1.3.2#3, so this PR cannot update that dependency just by replacing the SDK's sources. vcpkg needs its own zlib port update to 1.4; consumers then need a registry checkout/baseline that includes that update. Existing pinned baselines do not advance automatically. No unrelated registry PR or custom overlay is introduced here.

Validation

• Windows x64, Visual Studio 2026: SDK build and all 29 selected compression, HTTP encoding/decoding, payload decoding, and zlib utility tests passed.
• Linux x64, Ubuntu/WSL with GCC 13: SDK build and the same 29 selected tests passed.
• Standalone zlib: both normal and 64-bit-offset example tests passed on Windows and Linux; Windows 64-bit static consumer also compiled under /W4 /WX and ran successfully.
• Linux static-library symbol inspection: every defined global symbol retains the SDK's act_z_ prefix.
• vcpkg native and registry feature contracts, package dependency contracts, and all 13 release-port tests passed. These are recipe contract checks, not a full vcpkg package installation.
• Existing repository spellcheck lint and git diff --check passed.

Only targeted SDK suites were run; no selected tests were skipped. Existing unrelated GoogleTest CMake deprecations, MSVC warning-level override notices, and SQLite macro redefinition warnings remain. The standalone zlib build was also exercised without the SDK's third-party warning suppression.

CI runner compatibility

Replace the retired macos-14 iOS matrix lane with supported macos-26 and its installed iPhone 17 / iPad Pro 11-inch (M5) simulators. Keep the macos-15 lane and all eight debug/release phone/tablet combinations. Existing iOS deployment targets remain unchanged.

Verified supported labels and simulator inventories against GitHub's runner reference and the macOS 26 image inventory. Parsed workflow YAML and validated all expanded matrix combinations locally on Windows and Linux; existing spellcheck lint and whitespace checks passed. Actual Xcode/simulator execution requires hosted CI.

[Copilot]

🟡 Changes recommended

A partial transparent read followed by EIO can leave a stale buffer pointer, allowing subsequent reads to access memory beyond the allocation.

4 open issues

• Reset the output pointer before loading after partial read errors · New
• Order minizip before its dependencies in pkg-config output · New
• Export the installed minizip header directory to consumers · New
• Use minizip version variables for the shared-library SONAME · New

What changed in this PR

Updates the SDK’s vendored zlib to 1.4, bringing upstream security and correctness fixes while retaining SDK-specific symbol isolation and legacy library names. External vcpkg dependencies remain unchanged.

Changes:

• Refresh zlib and minizip sources, documentation, version metadata, and upstream provenance.
• Update Windows large-file support, packaging metadata, and standalone build/test integration.
• Refresh iOS CI runners, add an Android dependency mirror, and advance SDK/Swift package version references.

File	Description
zlib/​zutil.c	Fix allocation cleanup.
zlib/​zlib.pc.cmakein	Populate configured installation paths.
zlib/​zlib.h	Update version, API documentation, and large-file aliases.
zlib/​zlib.3	Update manual release information.
zlib/​zconf.h.in	Update offset types and Windows large-file support.
zlib/​zconf.h.cmakein	Synchronize CMake-generated offset definitions.
zlib/​zconf.h	Update bundled offset definitions.
zlib/​win32/​README-WIN32.txt	Update Windows release references.
zlib/​win32/​Makefile.msc	Remove the fixed DLL base address.
zlib/​uncompr.c	Use portable null-pointer macros.
zlib/​trees.c	Bound character classification input.
zlib/​treebuild.xml	Update package version metadata.
zlib/​test/​minigzip.c	Improve memory-mapping portability.
zlib/​test/​infcover.c	Extend invalid-dictionary coverage and allocation handling.
zlib/​qnx/​package.qpg	Update QNX library version references.
zlib/​Makefile.in	Update version and AIX export generation.
zlib/​inftrees.h	Adjust workaround decoding-table limits.
zlib/​inftrees.c	Update version and invalid-code entries.
zlib/​inflate.h	Track requested window and wrapper settings.
zlib/​inflate.c	Fix reset, synchronization, dictionary, and copy handling.
zlib/​infback.c	Correct fast-path window bookkeeping.
zlib/​gzwrite.c	Fix buffering, zero-fill, and stalled-write handling.
zlib/​gzread.c	Revise buffered errors, skipping, and stream-end handling.
zlib/​gzlib.c	Harden file opening, seeking, and error state.
zlib/​gzguts.h	Add portable blocking checks and offset limits.
zlib/​deflate.c	Fix reset, priming, copying, and block completion.
zlib/​crc32.c	Explicitly cast the initial braid checksum.
zlib/​contrib/​pascal/​zlibpas.pas	Update Pascal version constants.
zlib/​contrib/​minizip/​zip.h	Document extra-field size limits.
zlib/​contrib/​minizip/​zip.c	Harden ZIP64 metadata, parsing, and cleanup.
zlib/​contrib/​minizip/​unzip.h	Clarify truncated-string handling.
zlib/​contrib/​minizip/​unzip.c	Validate ZIP64 locations and extra-field boundaries.
zlib/​contrib/​minizip/​test/​find_package_wrong_components_test.cmake.in	Raise the test’s CMake minimum.
zlib/​contrib/​minizip/​test/​find_package_test.cmake.in	Update CMake minimum and format component requests.
zlib/​contrib/​minizip/​test/​find_package_no_components_test.cmake.in	Raise the test’s CMake minimum.
zlib/​contrib/​minizip/​test/​CMakeLists.txt	Revise package-test paths, fixtures, and platform options.
zlib/​contrib/​minizip/​test/​add_subdirectory_test.cmake.in	Raise the test’s CMake minimum.
zlib/​contrib/​minizip/​test/​add_subdirectory_exclude_test.cmake.in	Raise the test’s CMake minimum.
zlib/​contrib/​minizip/​skipset.h	Localize helpers and improve C compatibility.
zlib/​contrib/​minizip/​mztools.c	Use unsigned arithmetic for 32-bit reads.
zlib/​contrib/​minizip/​minizipConfig.cmake.in	Improve dependency and component reporting.
zlib/​contrib/​minizip/​miniunz.c	Sanitize extraction paths and revise directory creation.
zlib/​contrib/​minizip/​Makefile.am	Install integer definitions and link miniunzip with zlib.
zlib/​contrib/​minizip/​ioapi.h	Correct Android large-file feature detection.
zlib/​contrib/​minizip/​crypt.h	Switch encryption-header generation to PCG32.
zlib/​contrib/​minizip/​configure.ac	Update the Autoconf package version.
zlib/​contrib/​minizip/​CMakeLists.txt	Revise targets, installation metadata, and test setup.
zlib/​contrib/​infback9/​inftree9.c	Remove out-of-bounds table-pointer arithmetic.
zlib/​contrib/​dotzlib/​DotZLib/​UnitTests.cs	Update the expected zlib version.
zlib/​contrib/​delphi/​ZLib.pas	Update the Delphi version constant.
zlib/​configure	Improve generated-header and platform linker handling.
zlib/​compress.c	Use portable null-pointer macros.
zlib/​CMakeLists.txt	Update version, pkg-config paths, and Windows examples.
zlib/​ChangeLog	Record upstream 1.4 changes.
Package.swift	Update the binary release URL and checksum.
lib/​include/​public/​Version.hpp	Advance the SDK build version.
lib/​android_build/​build.gradle	Add a Maven Central mirror before the primary repository.
cgmanifest.json	Record the zlib 1.4 upstream commit.
.github/​workflows/​build-ios-mac.yml	Replace the macOS 14 lane and its simulators.

_{Review effort: Balanced}

[bmehta001]

These zlib comments CoPilot made are perhaps accurate, but I would prefer to copy the library as is rather than making my own modifications, so I am resolving them.

[Baiju Meswani (baijumeswani)]

I would hold approval until the read error-path and minizip packaging issues below are addressed. All 29 targeted SDK tests passed locally, but they do not cover these cases. The sanitizer reproduction was inconclusive.

[Copilot]

🟡 Changes recommended

A failed seek with 32-bit z_off_t can still advance the stream position, violating the documented position-preservation guarantee and affecting subsequent writes.

1 open issue

• Check offset representability before mutating the stream · New

4 previously missed issues

In code that hasn't changed since last review

Probe fopen64 with the library's large-file definition

zlib/​contrib/​minizip/​CMakeLists.txt:67

On glibc, fopen64 is declared only when _LARGEFILE64_SOURCE is enabled, but this symbol check runs before that definition is supplied. A default configuration therefore records HAVE_FOPEN64 as false and enables USE_FILE32API on both libraries. With the 32-bit build guard removed, supported 32-bit Linux builds now silently use ftell/fseek with 32-bit long, breaking ZIP64 access beyond 2 GiB despite the platform providing the 64-bit APIs. Run this probe with the same large-file definition used by the library.

Cached BZip2 feature state leaks across installations

zlib/​contrib/​minizip/​minizipConfig.cmake.in:8

Caching this package feature leaves stale dependency metadata when a consumer switches installations in the same build directory. After finding a BZip2-disabled minizip, finding a BZip2-enabled installation keeps the cached OFF value, skips find_dependency(BZip2), and leaves the exported libraries referring to an undefined BZip2::BZip2 target. Set this as a normal variable so it always reflects the installation being loaded.

Validate EOCD candidates before accepting comment signatures

zlib/​contrib/​minizip/​unzip.c:486

A valid ZIP64 archive whose global comment ends in PK\x05\x06 is now rejected because the classic-directory search treats those comment bytes as the end-of-central-directory record and misses the real ZIP64 locator. Validate each candidate's fixed header and declared comment length before using its position, while retaining the immediate-predecessor restriction for the locator. The same issue prevents appending in zlib/contrib/minizip/zip.c:840–842.

Avoid signed overflow when seeking from a negative position

zlib/​gzlib.c:395

pos can be negative: gzungetc() before the first read decrements x.pos from 0 to -1. A subsequent gzseek64(file, 1, SEEK_CUR) should consume that pushed-back byte and return 0, but GZ_OFF_MAX - pos overflows the signed offset type before this comparison (and rejects the seek on wrapping implementations). Only apply the upper-bound subtraction when pos is nonnegative; the following lower-bound check can still reject positions before the start.

4 resolved since last review

• Reset the output pointer before loading after partial read errors
• Use minizip version variables for the shared-library SONAME
• Export the installed minizip header directory to consumers
• Order minizip before its dependencies in pkg-config output

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Unresolved issues can reject valid ZIP64 archives, break consumer configuration when switching BZip2 dependencies, and truncate or fail large-file offsets on 32-bit builds.

No open issues 🎉

3 previously missed issues

In code that hasn't changed since last review

Probe fopen64 with the library's large-file feature macro

zlib/​contrib/​minizip/​CMakeLists.txt:67

This declaration check runs without _LARGEFILE64_SOURCE, so glibc reports HAVE_FOPEN64 as false even when the function is available. Both minizip targets then enable USE_FILE32API, which maps the 64-bit seek/tell functions to fseek/ftell in ioapi.h. With the 32-bit build restriction removed, offsets above LONG_MAX can now be truncated or fail. Run this probe with the same large-file feature macro used to compile the library.

Avoid caching the package's bzip2 dependency setting

zlib/​contrib/​minizip/​minizipConfig.cmake.in:8

Caching this package property preserves the old value when a consumer reconfigures against a different minizip installation. For example, switching from a build without bzip2 to one with bzip2 leaves the cached value OFF, skips find_dependency(BZip2), and imports targets referencing an undefined BZip2::BZip2, causing generation to fail. Set this as a normal variable so it always reflects the loaded package's compiled dependencies.

Skip invalid EOCD signatures when searching for the real record

zlib/​contrib/​minizip/​unzip.c:486

The classic end-of-central-directory (EOCD) search accepts signatures inside comments, so a valid ZIP64 archive whose comment ends with PK\x05\x06 now fails to open because the lookup misses the real ZIP64 locator and reads a truncated header. Validate each candidate's fixed header and declared comment length, continuing past invalid matches while retaining the adjacent-locator restriction. The same regression affects opening archives for append in zlib/contrib/minizip/zip.c:840–842; update both search helpers.

1 resolved since last review

• Check offset representability before mutating the stream

_{Review effort: Balanced}

[bmehta001]

Addressed all three remaining minizip summary advisories from review 5801043339 in ddf90d2:

• Large-file probe: detect fopen64 with _LARGEFILE64_SOURCE=1, matching library compilation, while preserving/restoring CMake's required-check state. Linux now detects the symbol and does not select USE_FILE32API.
• BZip2 dependency state: read the installed package's feature setting as a normal variable instead of retaining a consumer cache option. Tests cover stale opposite-valued caches; an actual installed consumer also reconfigured and built OFF -> ON -> OFF without clearing its cache.
• EOCD search: skip candidate signatures unless a complete 22-byte header is available and the declared comment ends at EOF. Both read and append continue backwards to the real record, and the adjacent ZIP64-locator rule remains unchanged.

Added shared/static regressions covering classic/ZIP64 read and append, self-extracting prefixes, truncated false signatures, incorrect comment lengths, scan-window boundaries, 65,535-byte comments, and seeks beyond 4 GiB. The archive and cached-dependency regressions failed on both Windows and Linux before the production fixes.

Validation: standalone suites 11/11 Windows VS 2026, 11/11 Linux BZip2 OFF, 11/11 Linux BZip2 ON; integrated upstream zlib+minizip 24/24 Windows, 28/28 Linux. No tests were skipped or filtered in these passing suites. Spelling checks and git diff --check pass. Local 32-bit Linux runtime testing is unavailable because the multilib CRT is not installed.

The identical fixes and regressions are also pushed to the existing upstream PR: madler/zlib#1375 (ed3cc8c89d8b0bd359759f2c7897ebcfd5a31a28).

[Copilot]

🔵 Needs a closer look

Human assessment is needed for omitted findings involving undefined behavior in fresh-stream gzip handling and unusable pkg-config metadata for static-only MinGW builds.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed to evaluate critical undefined behavior in normal gzip use alongside parallel-test races and platform-specific packaging failures.

No open issues 🎉

1 resolved since last review

• Check offset representability before mutating the stream

_{Review effort: Balanced}

[bmehta001]

Follow-up validation: 00c3446 fixes DLL deployment for the new shared archive regression on Cygwin (where WIN32 is false). The identical upstream follow-up now passes all 26 Cygwin tests, including both shared/static archive regressions, without excluding tests: https://github.com/madler/zlib/actions/runs/42235455471/job/127951741676

The three requested minizip advisories remain fixed. The latest Copilot review (5801785602) on this exact SDK head adds no inline comments, but its summary raises different, additional advisories involving normal/fresh-stream gzip undefined behavior, parallel-test races, and platform-specific packaging. These have not been resolved by this three-advisory batch and should not be confused with a fully clean review. The previous pass specifically mentioned static-only MinGW pkg-config metadata; that is also not addressed here.

Windows/Linux x64 suites and the Cygwin job pass. The wider SDK and upstream CI matrices are still running, with no failures currently reported on either new head.

[bmehta001]

Addressed the three remaining summary advisories in ca92318:

• Fresh-reader gzip seeks no longer evaluate an uninitialized output pointer when the skip count is zero. Added fresh seeks to offsets 0 and 1 to the existing gzip example. This was confirmed from source; the sanitizer baseline did not reproduce a diagnostic, so I am not claiming a before/after sanitizer failure.
• Reproduced parallel example/example64 archive corruption before the fix. Each now uses its own filename; both pass 20 parallel repetitions on Windows and Linux. Upstream already isolates those filenames; this was specific to the SDK's older CMake layout.
• Static-only minizip pkg-config metadata now names the actual libraries (including Windows/MinGW static suffixes and Debug postfixes). Added a consumer that links using the installed pkg-config output, not the CMake minizip target.

Validation: Windows VS 2026 shared/static minizip 11/11; Windows static-only 10/10 plus a native MSVC consumer compiled, linked and ran using actual pkg-config --msvc-syntax output. Linux mixed builds 13/13 each and static-only builds 12/12 each, with BZip2 both OFF and ON. Integrated upstream package tests passed on Windows and Linux. Linux MemorySanitizer/UBSan gzip examples passed. No tests were skipped; existing WILL_FAIL cases intentionally check invalid package requests.

Upstream packaging follow-up: madler/zlib#1375 (057660cc), including a real static-only MinGW pkg-config CI job. The fresh-reader guard is also being added to the existing upstream seek PR.

[bmehta001]

The new upstream exact-platform checks are now green: mingw64 passed 30/30 standard tests plus 4/4 static-only archive/pkg-config checks on 057660cc; Cygwin also passed. This validates the actual minizips/zs static archive names rather than relying only on Linux or MSVC. The upstream fresh-reader fix is now published as afb49d12 in madler/zlib#1376.

[Copilot]

🔵 Needs a closer look

Human assessment is needed to evaluate critical undefined behavior from an uninitialized pointer in gzip handling and pkg-config metadata defects that can break downstream consumers.

No open issues 🎉

_{Review effort: Balanced}

[bmehta001]

The follow-up review (5805099783) still flagged gzip pointer initialization and metadata, without inline locations. A further source trace found a second real gzip path: gzdirect() calls gz_skip_have() after header detection even when x.have is zero, so that helper also needed the zero-count guard. Fixed in eca744f and covered by calling gzdirect() before fresh-reader seeks. Windows/Linux examples and Linux MemorySanitizer/UBSan tests pass. Upstream: d97e3053 in madler/zlib#1376.

The new upstream pkg-config consumer also exposed an OpenBSD failure. Dependency metadata now includes imported library search directories (e.g. BZip2 under /usr/local/lib), and resolves BZip2 filenames per configuration rather than hardcoding bz2. The consumer test no longer supplies zlib's library directory separately, so all library paths must come from the .pc file. Linux mixed/static-only BZip2 OFF/ON consumers pass; native MSVC links and runs using only pkg-config-provided library flags. The fresh OpenBSD/MinGW/Cygwin CI run is pending on upstream 5107ca28.

[Copilot]

🔵 Needs a closer look

Human assessment is needed because minizip’s pkg-config metadata can omit non-system zlib include paths, while manually supplied paths in the consumer test can mask resulting build failures.

No open issues 🎉

_{Review effort: Balanced}

[bmehta001]

Fixed the new external-zlib-header advisory from review 5805277855 in eb7d0ef. Minizip's public headers include zlib.h, so pkg-config now exports the imported zlib target's include directories. Removed find_package(ZLIB) and all manually injected dependency include/library directories from the pkg-config consumer; it now uses only pkg-config output.

Reproduced the exact failure before the fix with native VS 2026: fatal C1083, cannot open zlib.h. The same consumer now compiles, links and runs using only pkg-config --cflags/--static --libs --msvc-syntax, with no supplied dependency paths. All five Linux consumer configurations (mixed/static-only with BZip2 OFF/ON, plus integrated upstream) pass. No tests were skipped. Equivalent upstream fix: c16e80b9 in madler/zlib#1375.

[Copilot]

🔵 Needs a closer look

Human assessment is needed because the published review omits a critical gzip seek overflow that can hang reads and a pkg-config defect that breaks absolute installation paths.

No open issues 🎉

_{Review effort: Balanced}

[bmehta001]

Addressed only the two advisories in review 5805454467, in 95ba388:

• Gzip seek overflow: add a two-line bounds check before computing the pending skip distance. A reader positioned before byte zero by gzungetc now rejects an unrepresentable distance without changing position. The existing example regression reproduced the failure on Windows and Linux; it also exercises gzseek64 explicitly.
• Absolute pkg-config install paths: preserve absolute CMAKE_INSTALL_LIBDIR/CMAKE_INSTALL_INCLUDEDIR values rather than prepending exec_prefix. Relative-path relocation remains unchanged. Adapt the existing pkg-config consumer to locate an absolute library directory.

Validation: gzip examples 2/2 on Windows VS 2026 and 2/2 on Linux; Linux UBSan 2/2. Default static minizip suites 10/10 Windows and 12/12 Linux. Targeted absolute-layout checks 2/2 Windows and 4/4 Linux, plus real pkg-config-only consumers compiled, linked and ran on both platforms. Those consumers fail against the unchanged metadata with missing public headers. Existing spelling checks and git diff --check pass.

Absolute-layout validation is deliberately scoped to archive/install/pkg-config behavior: the broader package-discovery harness assumes a relative installation layout, and a deeply nested Windows scratch build also hit path-length errors. I have not expanded this batch into unrelated harness or vendored-zlib cleanups. No selected tests were skipped; existing WILL_FAIL tests intentionally reject invalid component requests. Hosted CI on the new commit remains pending.