Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Bundled exiv2 DLL statically links zlib 1.2.11 (January 2017)

未关闭
  • 哪里不对？
#1,975 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
45/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
冷清
技术栈
csharp
领域
desktop, security

调研方向

从 QuickLook.Plugin/QuickLook.Plugin.ImageViewer/ 开始，重点查看 MetaProvider.cs 和插件的 .csproj，以追踪已提交的 exiv2-ql-64.dll 和 exiv2-ql-32.dll。使用所示的 strings 命令检查这些 DLL，并确定如何重新构建它们；完成标准是，随附的二进制文件使用当前的 zlib，并且其相关版本和 CVE 可达性都有文档记录。

由索引模型根据 Issue 内容生成。

描述

Hello — and first, some history I should own rather than skip past.

I raised #1972 here previously and I was wrong: I suggested SHA-pinning an action reference that was a deliberately maintained release branch. So I'd understand a degree of scepticism. I've tried to be more careful this time, and I've written down explicitly what I did not establish.

What I observed

QuickLook.Plugin/QuickLook.Plugin.ImageViewer/ commits prebuilt exiv2 binaries — exiv2-ql-64.dll (2.4 MB) and exiv2-ql-32.dll (2.1 MB) — referenced from MetaProvider.cs and the plugin's .csproj.

Those DLLs statically link zlib, and zlib writes its own version banner into the binary:

$ strings exiv2-ql-64.dll | grep -iE 'inflate|deflate'
deflate 1.2.11 Copyright 1995-2017 Jean-loup Gailly and Mark Adler
inflate 1.2.11 Copyright 1995-2017 Mark Adler

zlib 1.2.11 is from January 2017. Current is 1.3.1.

The advisories in that range

CVE CVSS
CVE-2022-37434 9.8 CRITICAL heap-based buffer over-read/overflow in inflate via a large gzip header extra field. Fixed in 1.2.13
CVE-2018-25032 7.5 HIGH memory corruption when deflating if the input has many distant matches. Fixed in 1.2.12

What I did NOT establish — and it matters for both

Neither CVE is shown to be reachable here, and I'm not claiming either is exploitable.

  • CVE-2022-37434 — NVD notes it applies only to applications that call inflateGetHeader. I did not determine whether exiv2 ever calls that. If it doesn't, this one simply doesn't apply.
  • CVE-2018-25032 — that's the deflate (compression) path. QuickLook previews images, which is mostly a read path; whether exiv2 compresses during metadata handling I did not establish.

What I think is fair to say: a nine-year-old zlib ships inside a plugin whose job is parsing untrusted image files, and nothing in the project's tooling can see it.

Why it's invisible

zlib here is statically linked inside another prebuilt binary. There's no manifest entry for exiv2, let alone for the zlib within it. Dependabot has nothing to read, no source scanner parses a PE binary, and the version is only recoverable by running strings and recognising zlib's copyright banner.

I also could not determine exiv2's own version — the binary exposes zlib's banner but no clean exiv2 version string — so I can't tell you how old the exiv2 itself is.

Suggestion

Rebuilding the bundled exiv2 against a current zlib (1.3.1) would close it. That's regenerating a binary rather than editing a manifest, which is precisely why it went unnoticed — no criticism intended.

Disclosure: AI-assisted (Claude Opus 5). I read the version banner out of the committed DLL, confirmed the plugin references, and fetched both CVEs from NVD myself before posting.

主要语言
C#
星标
25.5k
派生
1.4k
平均合并
14 小时 38 分钟
30 天内合并 PR
1

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 有 Pull Request 模板
  • 没有贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

QL-Win/QuickLook 的其他 Issue

查看 QL-Win/QuickLook 的全部 Issue

相似的 Issue

更多 C# Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。