Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Bundled exiv2 DLL statically links zlib 1.2.11 (January 2017)

Aperta
  • Qualcosa non va?
#1,975 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
csharp
Ambito
desktop, security

Direzione di ricerca

Inizia in QuickLook.Plugin/QuickLook.Plugin.ImageViewer/, in particolare con MetaProvider.cs e il .csproj del plugin, per ricostruire il percorso di exiv2-ql-64.dll e exiv2-ql-32.dll inclusi nel repository. Ispeziona le DLL con il comando strings mostrato e determina come possono essere ricompilate; il lavoro è completato quando i binari inclusi usano una versione aggiornata di zlib e sono documentate le relative versioni e la raggiungibilità dei CVE.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Hello — and first, some history I should own rather than skip past.

I raised #1972 here previously and I was wrong: I suggested SHA-pinning an action reference that was a deliberately maintained release branch. So I'd understand a degree of scepticism. I've tried to be more careful this time, and I've written down explicitly what I did not establish.

What I observed

QuickLook.Plugin/QuickLook.Plugin.ImageViewer/ commits prebuilt exiv2 binaries — exiv2-ql-64.dll (2.4 MB) and exiv2-ql-32.dll (2.1 MB) — referenced from MetaProvider.cs and the plugin's .csproj.

Those DLLs statically link zlib, and zlib writes its own version banner into the binary:

$ strings exiv2-ql-64.dll | grep -iE 'inflate|deflate'
deflate 1.2.11 Copyright 1995-2017 Jean-loup Gailly and Mark Adler
inflate 1.2.11 Copyright 1995-2017 Mark Adler

zlib 1.2.11 is from January 2017. Current is 1.3.1.

The advisories in that range

CVE CVSS
CVE-2022-37434 9.8 CRITICAL heap-based buffer over-read/overflow in inflate via a large gzip header extra field. Fixed in 1.2.13
CVE-2018-25032 7.5 HIGH memory corruption when deflating if the input has many distant matches. Fixed in 1.2.12

What I did NOT establish — and it matters for both

Neither CVE is shown to be reachable here, and I'm not claiming either is exploitable.

  • CVE-2022-37434 — NVD notes it applies only to applications that call inflateGetHeader. I did not determine whether exiv2 ever calls that. If it doesn't, this one simply doesn't apply.
  • CVE-2018-25032 — that's the deflate (compression) path. QuickLook previews images, which is mostly a read path; whether exiv2 compresses during metadata handling I did not establish.

What I think is fair to say: a nine-year-old zlib ships inside a plugin whose job is parsing untrusted image files, and nothing in the project's tooling can see it.

Why it's invisible

zlib here is statically linked inside another prebuilt binary. There's no manifest entry for exiv2, let alone for the zlib within it. Dependabot has nothing to read, no source scanner parses a PE binary, and the version is only recoverable by running strings and recognising zlib's copyright banner.

I also could not determine exiv2's own version — the binary exposes zlib's banner but no clean exiv2 version string — so I can't tell you how old the exiv2 itself is.

Suggestion

Rebuilding the bundled exiv2 against a current zlib (1.3.1) would close it. That's regenerating a binary rather than editing a manifest, which is precisely why it went unnoticed — no criticism intended.

Disclosure: AI-assisted (Claude Opus 5). I read the version banner out of the committed DLL, confirmed the plugin references, and fetched both CVEs from NVD myself before posting.

Lingua principale
C#
Stelle
25.5k
Fork
1.4k
Merge medio
14h 38m
PR unite (30g)
1

Preparare l'ambiente

  • Nessun Dockerfile né file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di QL-Win/QuickLook

Tutte le issue di QL-Win/QuickLook

Issue simili

Altre issue su C#

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.