zlib-rs 0.6.7 is out today as the newest version of this "safer zlib" implementation making use of the Rust programming language and aiming to deliver performance on-par with zlib-ng.

The zlib-rs 0.6.7 release fixes a new use-after-free vulnerability discovered in its codebase. This ticket from yesterday outlines the use-after-free condition in Deflate::compress_uninit along with a proof of concept example. The PoC can trigger the UAF even with forbidding any unsafe Rust features in the code.

The other big focus with zlib-rs 0.6.7 is on shipping more LoongArch64 LSX optimizations for that Loongson SIMD eXtension. There is now a LSX compare256 implementation yielding around a 4% speed-up in one test. In the inflate code it's also now using wider loads/stores with LSX for up toa 10% improvement. and other fixes.

Soon I'll be working on a fresh round of Loongson 3B6000 benchmarks for my lone LoongArch test system.

Downloads and more details on zlib-rs 0.6.7 via GitHub.