mirrors/cpython
0
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2024-11-23 09:54:58 +08:00
Code Issues Packages Projects Releases Wiki Activity

gh-113977, gh-120754: Remove unbounded reads from zipfile (GH-122101)

Browse Source 
GH-113977, GH-120754: Remove unbounded reads from zipfile

Read without a size may read an unbounded amount of data + allocate
unbounded size buffers. Move to capped size reads to prevent potential
issues.

Co-authored-by: Daniel Hillier <daniel.hillier@gmail.com>
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
This commit is contained in:
Cody Maloney 2024-11-02 22:28:51 -07:00 committed by GitHub
parent 8161afe51c
commit 556dc9b8a7
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Lib/zipfile/__init__.py
View File

@ -309,7 +309,7 @@ def _EndRecData(fpin):
fpin.seek(-sizeEndCentDir, 2) fpin.seek(-sizeEndCentDir, 2)
except OSError: except OSError:
return None return None
data = fpin.read() data = fpin.read(sizeEndCentDir)
if (len(data) == sizeEndCentDir and if (len(data) == sizeEndCentDir and
data[0:4] == stringEndArchive and data[0:4] == stringEndArchive and
data[-2:] == b"\000\000"): data[-2:] == b"\000\000"):
@ -329,9 +329,9 @@ def _EndRecData(fpin):
# record signature. The comment is the last item in the ZIP file and may be # record signature. The comment is the last item in the ZIP file and may be
# up to 64K long. It is assumed that the "end of central directory" magic # up to 64K long. It is assumed that the "end of central directory" magic
# number does not appear in the comment. # number does not appear in the comment.
maxCommentStart = max(filesize - (1 << 16) - sizeEndCentDir, 0) maxCommentStart = max(filesize - ZIP_MAX_COMMENT - sizeEndCentDir, 0)
fpin.seek(maxCommentStart, 0) fpin.seek(maxCommentStart, 0)
data = fpin.read() data = fpin.read(ZIP_MAX_COMMENT + sizeEndCentDir)
start = data.rfind(stringEndArchive) start = data.rfind(stringEndArchive)
if start >= 0: if start >= 0:
# found the magic number; attempt to unpack and interpret # found the magic number; attempt to unpack and interpret

1
Misc/NEWS.d/next/Library/2024-07-23-02-24-50.gh-issue-120754.nHb5mG.rst Normal file
View File

@ -0,0 +1 @@
Update unbounded ``read`` calls in :mod:`zipfile` to specify an explicit ``size`` putting a limit on how much data they may read. This also updates handling around ZIP max comment size to match the standard instead of reading comments that are one byte too long.