The ISRG (Internet Security Research Group), which is the founder of the Let's Encrypt project and promotes the development of technologies to enhance internet security, has introduced the zlib-rs project aimed at creating a secure alternative to the zlib data compression library. The zlib-rs code is written in Rust and is distributed under the Zlib license. Development is being done with an eye on the zlib-ng project, which develops a high-performance version of zlib. The project has developed two libraries: zlib-rs, which implements the zlib API without using unsafe blocks; and libz-rs-sys, a wrapper that supports the C API and contains code in an
The reason for creating zlib-rs is noted to provide a version of zlib free from potential vulnerabilities caused by memory errors. According to Microsoft and Google, about 70% of vulnerabilities are due to unsafe memory handling. It is believed that using Rust for developing zlib-rs will reduce the risk of vulnerabilities caused by unsafe memory operations and eliminate errors such as accessing memory after it has been freed and buffer overflows.
The zlib library is widely used as a dependency in many systems, despite the fact that dangerous vulnerabilities sometimes surface in the zlib code. For example, in 2022, a buffer overflow was found in zlib when attempting to compress a specially crafted string sequence, which allowed the vulnerability to be exploited by passing specially formatted input data.
Source: opennet.ru
