[PGZXB]

Fixes #3109

doWrite selects the compression function from strategy_ before it
considers level_. A deflate_stream reset with level = 0 (store only)
and Strategy::rle therefore runs f_rle, which emits a stored block
without capping its size against the pending buffer. With memLevel = 1
the pending buffer is 512 bytes, so a 508-byte stored block plus its header
overruns it by one byte (ASan reports a heap-buffer-overflow WRITE of 508 in
copy_block).

As in zlib, level 0 means "store only" regardless of the strategy. Do the
same here: when level_ == 0, deflate_rle delegates to f_stored, which
enforces the pending-buffer cap, instead of entering the RLE compressor.

diff --git a/include/boost/beast/zlib/detail/deflate_stream.hpp b/include/boost/beast/zlib/detail/deflate_stream.hpp
index 6f39569..15221f9 100644
--- a/include/boost/beast/zlib/detail/deflate_stream.hpp
+++ b/include/boost/beast/zlib/detail/deflate_stream.hpp
@@ -680,6 +680,8 @@ protected:
     block_state
     deflate_rle(z_params& zs, Flush flush)
     {
+        if(level_ == 0)
+            return f_stored(zs, flush);
         return f_rle(zs, flush);
     }

Verification

Reproducer from #3109:

zlib::deflate_stream ds;
ds.reset(0, 9, 1, zlib::Strategy::rle);

std::vector<std::uint8_t> input(508, 'A');
std::vector<std::uint8_t> out(zlib::deflate_upper_bound(input.size()) + 64);

zlib::z_params zp;
zp.next_in  = input.data();
zp.avail_in = input.size();
zp.next_out = out.data();
zp.avail_out = out.size();

boost::system::error_code ec;
ds.write(zp, zlib::Flush::finish, ec);

Before: ASan reports a heap-buffer-overflow write in
deflate_stream::copy_block, reached from f_rle.

After: the reproducer runs to completion with no sanitizer report.

[ashtum]

Thanks for your PR.

This issue will be addressed by #3114, along with some additional improvements.