zlib: backport fix for heap-based buffer over-read (CVE-2022-37434)