InsightSoftwareConsortium / InsightSoftwareConsortium/ITK

Re-vendor MetaIO for Z_STREAM_END uncompression check (blocked on Kitware/MetaIO#145)

Open
#6,694 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
1.7k
Forks
748
Avg merge
1d 1h
Merged PRs (30d)
64

Description

## Summary

The vendored MetaIO `MET_PerformUncompression` (`Modules/ThirdParty/MetaIO/src/MetaIO/src/metaUtils.cxx`) validates the number of decompressed bytes but not that the zlib stream reached `Z_STREAM_END`. A compressed stream truncated exactly at the declared output size is therefore accepted, and its trailing Adler-32 checksum is never verified.

Surfaced by an automated review on #6692 (MetaIO `8c41a1d9` re-vendor, now merged).

## Blocked on upstream

MetaIO is vendored from Kitware/MetaIO, so this must be fixed upstream and re-vendored — it must **not** be patched in-place in `Modules/ThirdParty/MetaIO/` (an `UpdateFromUpstream.sh` run would overwrite a local edit).

- Upstream issue: **Kitware/MetaIO#144**
- Upstream fix: **Kitware/MetaIO#145** (adds the `Z_STREAM_END` guard) — **must merge first**

## Resolution steps (once Kitware/MetaIO#145 merges)

1. Run `Modules/ThirdParty/MetaIO/UpdateFromUpstream.sh` to re-vendor MetaIO at the post-#145 snapshot (two-parent vendor merge, per ITK ThirdParty conventions).
2. Confirm the `Z_STREAM_END` check is present in the re-vendored `metaUtils.cxx`.
3. Verify `ITKIOMeta` tests still pass (the new upstream regression tests `testMeta13ImageList` / `testMeta14ImageCompressed` plus the module suite).

Root cause

When the decompressed data fills the destination buffer exactly, the last `inflate()` returns `Z_OK` and the next call (with `avail_out == 0`) returns `Z_BUF_ERROR` — which is `< 0`, so the loop exits, but `Z_BUF_ERROR` is deliberately excluded from the "Uncompress failed" diagnostic. Control reaches the final check with `dest_pos == uncompressedDataSize` and the function returns `true`, even though `Z_STREAM_END` was never reached. See the Greptile P1 thread on #6692 and Kitware/MetaIO#144 for the full trace.

Contributor guide

Open the contributing guide

Research direction

Wait for Kitware/MetaIO#145 to merge, then run Modules/ThirdParty/MetaIO/UpdateFromUpstream.sh. Inspect Modules/ThirdParty/MetaIO/src/MetaIO/src/metaUtils.cxx for the upstream check, and run the ITKIOMeta module tests, including testMeta13ImageList and testMeta14ImageCompressed. Done means the post-fix vendored snapshot is present and the tests pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
build-system, testing
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.