From df84af25dc1942490e1d1c899a07619152a46148 Mon Sep 17 00:00:00 2001
From: Mark Adler <git@madler.net>
Date: Wed, 16 Sep 2026 16:26:14 -0700
Subject: [PATCH] Fix buffer overflow bug in non-blocking gzwrite.

This addresses CVE-2026-85091.
---
 gzwrite.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/gzwrite.c b/gzwrite.c
index b217b85ce..512329244 100644
--- a/gzwrite.c
+++ b/gzwrite.c
@@ -242,8 +242,11 @@ local z_size_t gz_write(gz_statep state, voidpc buf, z_size_t len) {
             n -= state->strm.avail_in;
             state->x.pos += n;
             len -= n;
-            if (ret == -1)
+            if (ret == -1) {
+                state->strm.avail_in = 0;
+                state->strm.next_in = state->in;
                 return state->again ? put - len : 0;
+            }
         } while (len);
     }