In zlib (inflate.c) 1.2.3.5 through 1.3.2, calling inflateSync() with windowBits 0 before a zlib/gzip header has been read leaves the window size at zero, so inflate allocates a one-byte window. If the stream is then reused with inflateReset2() and a crafted header sets a real window size, updatewindow() copies up to 32 KB of decompressed data into that one-byte buffer, causing a heap overflow. Fixed in zlib 1.4.