C ++ - support for Zlib - Header and No Header. How reliable?

Question

I am currently working on a huge project that possibly compresses / decompresses using zlib in C ++ more than a thousand documents per day. (Our implementation has zlib 1.2.8)

Our current implementation supports a compressed file with and without headers, however, you must set the logical "useZlibHeader".

Our team wondered if there was instead a 100% reliable way to find out if headers were present or not.

According to this document: https://www.ietf.org/rfc/rfc1950.txt it says: "The FCHECK value must be such that CMF and FLG, if we consider them as a 16-bit unsigned integer, stored in MSB order ( CMF * 256 + FLG), a multiple of 31. "

Indeed, this is a good check, but there are opportunities that we get in a compressed file that does not have a header, but its data is made that (CMF * 256 + FLG) will be a multiple of 31.

Is there a better way to determine if headers are present or not? Is it possible that we may not detect the presence of a header well and that decompression does not throw an exception, outputting bad data?

thanks

Answer 1

As a heuristic check, it will be unreliable and exploitable. I can imagine creating a document that compiles to the zlib header. A valid decompression stream will also be issued if the header was considered valid.

In fact, restrictions on transmitted data may be relaxed, but they can be dangerous.