The call to zlib basically overwrites a minimal ELF into a portion of the `su` binary, which exceve's /bin/sh.