The zlib-rs 0.6.7 release fixes a new use-after-free vulnerability discovered in its codebase. This ticket from yesterday outlines the use-after-free condition in Deflate::compress_uninit along with a proof of concept example. The PoC can trigger the UAF even with forbidding any unsafe Rust features in the code.
The other big focus with zlib-rs 0.6.7 is on shipping more LoongArch64 LSX optimizations for that Loongson SIMD eXtension. There is now a LSX compare256 implementation yielding around a 4% speed-up in one test. In the inflate code it's also now using wider loads/stores with LSX for up toa 10% improvement. and other fixes.
Soon I'll be working on a fresh round of Loongson 3B6000 benchmarks for my lone LoongArch test system.
Downloads and more details on zlib-rs 0.6.7 via GitHub .