FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

gh-156002: Bound zipfile decompression for bzip2/LZMA/Zstandard by encukou · Pull Request #156003 · python/cpython · GitHub

/ cpython Public

gh-156002: Bound zipfile decompression for bzip2/LZMA/Zstandard - #156003

Merged
encukou merged 8 commits into
python:mainfrom
encukou:fix-zipfile-decompress-maxlength
Aug 24, 2026
ConversationCommits (8)ChecksFiles changed
Merged

gh-156002: Bound zipfile decompression for bzip2/LZMA/Zstandard#156003
encukou merged 8 commits into
python:mainfrom
encukou:fix-zipfile-decompress-maxlength

Conversation

encukou commented Aug 18, 2026 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Member

tonghuaroot and others added 6 commits June 23, 2026 09:34
GHSA-p384-rgv5-vhc2: Bound zipfile decompression for bzip2/LZMA/Zstan…
9097fc1 
…dard

zipfile.ZipExtFile._read1() bounds the output of each decompress() call
for DEFLATE members by passing a max_length to zlib, but for bzip2, LZMA,
and Zstandard members it called decompress() with no bound. A whole
compressed chunk was therefore expanded into a single allocation before
the data[:self._left] clip ran, so a consumer that deliberately reads in
small chunks to limit memory (for example zf.open(name).read(8192)) was
silently unprotected for non-DEFLATE members. A small, spec-conformant
archive member declaring a large uncompressed size could drive multi-GB
peak memory.

_read1() now passes a per-call bound to the non-DEFLATE decompress()
(mirroring the DEFLATE branch) and drains the decompressor's internal
buffer across calls by checking needs_input before reading more
compressed input. zipfile's LZMADecompressor wrapper forwards max_length
and exposes needs_input so the bound also holds for LZMA members.
GHSA-p384-rgv5-vhc2: Address review: private _needs_input and reword …
d61a324 
…bound comment
GHSA-p384-rgv5-vhc2: Rewrite the bound test to call _read1 directly
660522b 
Replace the Linux-only subprocess RSS test with a cross-platform check
that _read1() output is bounded by MIN_READ_SIZE for bzip2/LZMA/Zstandard.
GHSA-p384-rgv5-vhc2: Add ZIP_STORED/ZIP_DEFLATED bound tests; trim co…
6135ee6 
…mment
Merge in the main branch
2335538
Add a blurb
da69f5d
bedevere-app Bot mentioned this pull request Aug 18, 2026
Open
StanFromIreland reviewed Aug 19, 2026
View reviewed changes
Comment thread Lib/zipfile/__init__.py


def _decompressor_needs_input(decompressor):
# bz2/zstd expose the stdlib decompressor's public needs_input; the LZMA

StanFromIreland Aug 19, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

The LZMA wrapper is private, it's not in __all__ or documented, why not just make it a "public" property and avoid this little dance?

encukou Aug 19, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

That's one definition of “private” :)

For the backports, I think it's best to be extra careful. Testing on 3.14.7 and having things break with 3.14.6 is not fun.

Let's make it public (& more maintainable) in 3.16 afterwards.

StanFromIreland reviewed Aug 20, 2026
View reviewed changes
Comment thread Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst

StanFromIreland Aug 20, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

This should be in Security.

tonghuaroot commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

Agreed — this bounds a decompression-bomb DoS, so Security is the right blurb category. Thanks for landing it!

encukou merged commit f897dbf into python:main Aug 24, 2026
54 checks passed
encukou deleted the fix-zipfile-decompress-maxlength branch August 24, 2026 11:34
encukou added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 pre-release feature fixes, bugs and security fixes labels Aug 24, 2026

miss-islington-app Bot commented Aug 24, 2026

Copy link
Copy Markdown

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

miss-islington-app Bot commented Aug 24, 2026

Copy link
Copy Markdown

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10.
🐍🍒⛏🤖

miss-islington-app Bot commented Aug 24, 2026

Copy link
Copy Markdown

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

miss-islington-app Bot commented Aug 24, 2026

Copy link
Copy Markdown

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

miss-islington-app Bot commented Aug 24, 2026

Copy link
Copy Markdown

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

miss-islington-app Bot commented Aug 24, 2026

Copy link
Copy Markdown

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.15.
🐍🍒⛏🤖

miss-islington-app Bot commented Aug 24, 2026

Copy link
Copy Markdown

Sorry, @encukou, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker f897dbf2f36a5935700b7c2d94d4681d2136b7d4 3.11

miss-islington-app Bot commented Aug 24, 2026

Copy link
Copy Markdown

Sorry, @encukou, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker f897dbf2f36a5935700b7c2d94d4681d2136b7d4 3.10

miss-islington-app Bot commented Aug 24, 2026

Copy link
Copy Markdown

Sorry, @encukou, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker f897dbf2f36a5935700b7c2d94d4681d2136b7d4 3.13

miss-islington-app Bot commented Aug 24, 2026

Copy link
Copy Markdown

Sorry, @encukou, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker f897dbf2f36a5935700b7c2d94d4681d2136b7d4 3.12

miss-islington-app Bot commented Aug 24, 2026

Copy link
Copy Markdown

Sorry, @encukou, I could not cleanly backport this to 3.14 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker f897dbf2f36a5935700b7c2d94d4681d2136b7d4 3.14

miss-islington-app Bot commented Aug 24, 2026

Copy link
Copy Markdown

Sorry, @encukou, I could not cleanly backport this to 3.15 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker f897dbf2f36a5935700b7c2d94d4681d2136b7d4 3.15

bedevere-app Bot commented Aug 25, 2026

Copy link
Copy Markdown

GH-156362 is a backport of this pull request to the 3.15 branch.

bedevere-app Bot removed the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label Aug 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

StanFromIreland StanFromIreland left review comments

Assignees

encukou

Labels

needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

Back | FazBrowse Home | New Git URL