> "but a vulnerability in zlib is still bad because it can return incorrect output" which is true as far as it goes, but it completely misses the important point that it prevents the attacker from accessing anything not inside zlib's sandbox -- say, connections to a database.

Wouldn't being able to impact the output of zlib decompression also impact whatever is subsequently working on that output next though (just 'moving the goalpost')?