The function gzprintf within zlib, when called with a string
longer than Z_PRINTF_BUFZISE (= 4096 bytes), can overflow
without giving a warning. zlib-1.1.4 and earlier exhibit
this behavior. There are no known exploits of the gzprintf
overrun, and only a few programs, including rpm2html and
gimp-print, are known to use the gzprintf function. The
problem has been fixed by checking the length of the output
string within gzprintf.
--<URL:http://rhn.redhat.com/errata/RHSA-2003-079.html>
885cb8d505