zlib-rs 0.6.7 is out today as the newest version of this "safer zlib" implementation making use of the Rust programming language and aiming to deliver performance on-par with zlib-ng.

The zlib-rs 0.6.7 release fixes a new use-after-free vulnerability discovered in its codebase. [1]This ticket from yesterday outlines the use-after-free condition in Deflate::compress_uninit along with a proof of concept example. The PoC can trigger the UAF even with forbidding any unsafe Rust features in the code.

The other big focus with zlib-rs 0.6.7 is on shipping more LoongArch64 LSX optimizations for that Loongson SIMD eXtension. There is now a [2]LSX compare256 implementation yielding around a 4% speed-up in one test. In the inflate code it's also now [3]using wider loads/stores with LSX for up toa 10% improvement. and other fixes.

Soon I'll be working on a fresh round of [4]Loongson 3B6000 benchmarks for my lone LoongArch test system.

Downloads and more details on zlib-rs 0.6.7 via [5]GitHub .



[1] https://github.com/trifectatechfoundation/zlib-rs/issues/551

[2] https://github.com/trifectatechfoundation/zlib-rs/pull/547

[3] https://github.com/trifectatechfoundation/zlib-rs/pull/548

[4] https://www.phoronix.com/review/loongson-3b6000-loongarch

[5] https://github.com/trifectatechfoundation/zlib-rs/releases/tag/v0.6.7