Skip to content

gh-149945: Fix potential OOM for gzip with large header #149979

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
serhiy-storchaka wants to merge 1 commit into
base: main
Choose a base branch
from
+30 −20
Open

gh-149945: Fix potential OOM for gzip with large header #149979

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 30 additions & 20 deletions Lib/gzip.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -484,14 +484,22 @@ def _read_exact(fp, n):
return data


def _read_until_null(fp, append_to):
def _read_until_null(fp, crc=None):
'''Read until the first encountered null byte in fp.
Append to given byte array object'''
while True:
s = fp.read(1)
append_to += s
if not s or s == b'\000':
break
If crc is not None, update and return the CRC.
'''
if crc is None:
while True:
s = fp.read(1)
if not s or s == b'\000':
break
else:
while True:
s = fp.read(1)
crc = zlib.crc32(s, crc)
if not s or s == b'\000':
break
return crc


def _read_gzip_header(fp):
Expand All @@ -517,30 +525,32 @@ def _read_gzip_header(fp):
return last_mtime
if flag == FNAME:
# Read and discard a null-terminated string containing the filename
while True:
s = fp.read(1)
if not s or s==b'\000':
break
_read_until_null(fp)
return last_mtime

# Processing for more complex flags. Save header parts for FHCRC checking.
header = bytearray(magic + base_header)
if flag & FHCRC:
crc = zlib.crc32(magic + base_header)
else:
crc = None
if flag & FEXTRA:
extra_len_bytes = _read_exact(fp, 2)
extra_len, = struct.unpack("<H", extra_len_bytes)
header += extra_len_bytes
header += _read_exact(fp, extra_len)
extra = _read_exact(fp, extra_len)
if crc is not None:
crc = zlib.crc32(extra_len_bytes, crc)
crc = zlib.crc32(extra, crc)
if flag & FNAME:
_read_until_null(fp, append_to=header)
crc = _read_until_null(fp, crc)
if flag & FCOMMENT:
_read_until_null(fp, append_to=header)
if flag & FHCRC:
crc = _read_until_null(fp, crc)
if crc is not None:
# Header CRC is the last 16 bits of a crc32.
header_crc, = struct.unpack("<H", _read_exact(fp, 2))
true_crc = zlib.crc32(header) & 0xFFFF
if header_crc != true_crc:
crc = crc & 0xFFFF
if header_crc != crc:
raise BadGzipFile(f"Corrupted gzip header. Checksums do not "
f"match: {true_crc:04x} != {header_crc:04x}")
f"match: {crc:04x} != {header_crc:04x}")
return last_mtime


Expand Down
Loading