Potential uninitialized access in zlib
I am not an expert in the zlib source tree nor am I familiar with the coding style of its authors, but I found this to be an interesting question.  I'd say it looks safe and my guess is the original authors are expecting offset to be initialized to zero. Update: OK, I misread an if statement; looking at it again it looks like it might be unsafe without a custom allocator, so we'd have to look at inflateInit et al. and the actual inflate logic to know for sure.

Explanation follows:

It looks like inflate_state is allocated with the ZALLOC macro.

That macro resolves to:

#define ZALLOC(strm, items, size) \
       (*((strm)-&gt;zalloc))((strm)-&gt;opaque, (items), (size))


According to comments in zlib.h, correct use of the library requires the caller to initialize the zalloc member being called:

The application must initialize zalloc, zfree and opaque before
   calling the init function.

If strm-&gt;zalloc is NULL, which I'd expect most callers to do, the library uses its own default implementation, zcalloc.

zcalloc, with some exceptions for ancient MS-DOS compilers and so long as sizeof(unsigned int) is greater than 1, ends up calling calloc.

calloc by definition zeroes out its data.

So, I'd say it's safe under the following conditions:


If you use a custom allocator, make sure it zeroes out the data.


2. sizeof(unsigned int) must be > 1.  (I'm guessing the standard guarantees that but I'm not certain.)

After the update: Now realizing that the allocations are not necessarily zeroed, I'd say it all depends on whether or not the local variable here can be used uninitialized, as the only assignment I see is based on that value.

Note that inflateInit, which calls inflateReset, which calls inflateResetKeep, seems to initialize the members that the assignments to here depends on, notably lenbits.  It looks like there are lots of size checks for overflow as well, eg: if ((unsigned)(here.bits) &lt;= bits) break;.  I haven't given it a thorough audit but I'd say everything I've seen so far looks safe.