zlib: gracefully set windowBits from 8 to 9

On 4 April 2017, Node.js versions v4.8.2 and v6.10.2 were
released. These versions bumped the vendored zlib library from
v1.2.8 to v1.2.11 in response to what it describes as low-severity
CVEs. In zlib v1.2.9, a change was made that causes an error to be
raised when a raw deflate stream is initialised with windowBits set
to 8.

In zlib v1.2.9, 8 become an invalid value for this parameter, and Node's zlib
module will crash if you call this:

```
zlib.createDeflateRaw({windowBits: 8})
```

On some versions this crashes Node and you cannot recover from it, while on some
versions it throws an exception. The permessage-deflate library up to
version v0.1.5 does make such a call with no try/catch

This commit reverts to the original behavior of zlib by gracefully changed
windowBits: 8 to windowBits: 9 for raw deflate streams.

PR-URL: https://github.com/nodejs-private/node-private/pull/95
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Sam Roberts <vieuxtech@gmail.com>

3 files changed, 31 insertions, 0 deletions

diff --git a/doc/api/zlib.md b/doc/api/zlib.md
index 8e5f14621b9..b0ea5146452 100644
--- a/doc/api/zlib.md
+++ b/doc/api/zlib.md
@@ -373,6 +373,14 @@ added: v0.5.8
 
 Returns a new [DeflateRaw][] object with an [options][].
 
+*Note*: An upgrade of zlib from 1.2.8 to 1.2.11 changed behavior when windowBits
+is set to 8 for raw deflate streams. zlib does not have a working implementation
+of an 8-bit Window for raw deflate streams and would automatically set windowBit
+to 9 if initially set to 8. Newer versions of zlib will throw an exception.
+This creates a potential DOS vector, and as such the behavior ahs been reverted
+in Node.js 8, 6, and 4. Node.js version 9 and higher will throw when windowBits
+is set to 8.
+
 ## zlib.createGunzip([options])
 <!-- YAML
 added: v0.5.8
diff --git a/lib/zlib.js b/lib/zlib.js
index ecddfda653f..079c413e2f9 100644
--- a/lib/zlib.js
+++ b/lib/zlib.js
@@ -266,6 +266,7 @@ function Gunzip(opts) {
 
 // raw - no header
 function DeflateRaw(opts) {
+  if (opts && opts.windowBits === 8) opts.windowBits = 9;
   if (!(this instanceof DeflateRaw)) return new DeflateRaw(opts);
   Zlib.call(this, opts, binding.DEFLATERAW);
 }
diff --git a/test/parallel/test-zlib.js b/test/parallel/test-zlib.js
index 13f1a2776ad..392fc5feadf 100644
--- a/test/parallel/test-zlib.js
+++ b/test/parallel/test-zlib.js
@@ -131,6 +131,28 @@ SlowStream.prototype.end = function(chunk) {
   return this.ended;
 };
 
+// windowBits: 8 shouldn't throw
+assert.doesNotThrow(() => {
+  zlib.createDeflateRaw({ windowBits: 8 });
+}, 'windowsBits set to 8 should follow legacy zlib behavior');
+
+{
+  const node = fs.createReadStream(process.execPath);
+  const raw = [];
+  const reinflated = [];
+  node.on('data', (chunk) => raw.push(chunk));
+
+  // Usually, the inflate windowBits parameter needs to be at least the
+  // value of the matching deflate’s windowBits. However, inflate raw with
+  // windowBits = 8 should be able to handle compressed data from a source
+  // that does not know about the silent 8-to-9 upgrade of windowBits
+  // that older versions of zlib/Node perform.
+  node.pipe(zlib.createDeflateRaw({ windowBits: 9 }))
+      .pipe(zlib.createInflateRaw({ windowBits: 8 }))
+      .on('data', (chunk) => reinflated.push(chunk))
+      .on('end', common.mustCall(
+        () => assert(Buffer.concat(raw).equals(Buffer.concat(reinflated)))));
+}
 
 // for each of the files, make sure that compressing and
 // decompressing results in the same data, for every combination