Merge tag 'v4.8.5' into v4.x-port

2017-10-24 v4.8.5 'Argon' (Maintenance) Release
Git-EVTag-v0-SHA512: 1e860c6502c3718af9f8f344b0b257f3d1d520acbabfdebba1d0b5ea1b375dddfb5c1afe3c076b6d9e18e816fecf20ecee2b6355965c4707df5fc1f63c8ccf08

Author: gibfahn

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Node.js ChangeLog
 
+## 2017-10-24, Version 4.8.5 'Argon' (Maintenance), @MylesBorins
+
+This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/oct-2017-dos/ for details on patched vulnerabilities.
+
+### Notable Changes
+
+* **zlib**:
+  - CVE-2017-14919 - In zlib v1.2.9, a change was made that causes an error to be raised when a raw deflate stream is initialized with windowBits set to 8. On some versions this crashes Node and you cannot recover from it, while on some versions it throws an exception. Node.js will now gracefully set windowBits to 9 replicating the legacy behavior to avoid a DOS vector. [nodejs-private/node-private#95](https://github.com/nodejs-private/node-private/pull/95)
+
+### Commits
+
+* [[`f5defa2a7c`](https://github.com/nodejs/node/commit/733578bb2e)] - **zlib**: gracefully set windowBits from 8 to 9 (Myles Borins) [nodejs-private/node-private#95](https://github.com/nodejs-private/node-private/pull/95)
+
 ## 2017-07-11, Version 4.8.4 'Argon' (Maintenance), @MylesBorins
 
 This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/ for details on patched vulnerabilities.

doc/api/zlib.md

@@ -373,6 +373,14 @@ added: v0.5.8
 
 Returns a new [DeflateRaw][] object with an [options][].
 
+*Note*: An upgrade of zlib from 1.2.8 to 1.2.11 changed behavior when windowBits
+is set to 8 for raw deflate streams. zlib does not have a working implementation
+of an 8-bit Window for raw deflate streams and would automatically set windowBit
+to 9 if initially set to 8. Newer versions of zlib will throw an exception.
+This creates a potential DOS vector, and as such the behavior ahs been reverted
+in Node.js 8, 6, and 4. Node.js version 9 and higher will throw when windowBits
+is set to 8.
+
 ## zlib.createGunzip([options])
 <!-- YAML
 added: v0.5.8

lib/zlib.js

@@ -266,6 +266,7 @@ function Gunzip(opts) {
 
 // raw - no header
 function DeflateRaw(opts) {
+  if (opts && opts.windowBits === 8) opts.windowBits = 9;
   if (!(this instanceof DeflateRaw)) return new DeflateRaw(opts);
   Zlib.call(this, opts, binding.DEFLATERAW);
 }

src/node_version.h

@@ -3,7 +3,7 @@
 
 #define NODE_MAJOR_VERSION 4
 #define NODE_MINOR_VERSION 8
-#define NODE_PATCH_VERSION 4
+#define NODE_PATCH_VERSION 5
 
 #define NODE_VERSION_IS_LTS 1
 #define NODE_VERSION_LTS_CODENAME "Argon"

test/parallel/test-zlib.js

@@ -131,6 +131,28 @@ SlowStream.prototype.end = function(chunk) {
   return this.ended;
 };
 
+// windowBits: 8 shouldn't throw
+assert.doesNotThrow(() => {
+  zlib.createDeflateRaw({ windowBits: 8 });
+}, 'windowsBits set to 8 should follow legacy zlib behavior');
+
+{
+  const node = fs.createReadStream(process.execPath);
+  const raw = [];
+  const reinflated = [];
+  node.on('data', (chunk) => raw.push(chunk));
+
+  // Usually, the inflate windowBits parameter needs to be at least the
+  // value of the matching deflate’s windowBits. However, inflate raw with
+  // windowBits = 8 should be able to handle compressed data from a source
+  // that does not know about the silent 8-to-9 upgrade of windowBits
+  // that older versions of zlib/Node perform.
+  node.pipe(zlib.createDeflateRaw({ windowBits: 9 }))
+      .pipe(zlib.createInflateRaw({ windowBits: 8 }))
+      .on('data', (chunk) => reinflated.push(chunk))
+      .on('end', common.mustCall(
+        () => assert(Buffer.concat(raw).equals(Buffer.concat(reinflated)))));
+}
 
 // for each of the files, make sure that compressing and
 // decompressing results in the same data, for every combination