4 people dcdd406ddb [3.13] gh-156002: Bound zipfile decompression for bzip2/LZMA (GH-156003) (GH-156362) (#156738) ...

* [3.15] gh-156002: Bound zipfile decompression for bzip2/LZMA/Zstandard (GH-156003) (GH-156362)

Patch by @tonghuaroot.

zipfile.ZipExtFile._read1() bounds the output of each decompress() call
for DEFLATE members by passing a max_length to zlib, but for bzip2, LZMA,
and Zstandard members it called decompress() with no bound. A whole
compressed chunk was therefore expanded into a single allocation before
the data[:self._left] clip ran, so a consumer that deliberately reads in
small chunks to limit memory (for example zf.open(name).read(8192)) was
silently unprotected for non-DEFLATE members. A small, spec-conformant
archive member declaring a large uncompressed size could drive multi-GB
peak memory.

_read1() now passes a per-call bound to the non-DEFLATE decompress()
(mirroring the DEFLATE branch) and drains the decompressor's internal
buffer across calls by checking needs_input before reading more
compressed input. zipfile's LZMADecompressor wrapper forwards max_length
and exposes needs_input so the bound also holds for LZMA members.

(cherry picked from commit f897dbf2f3)
(cherry picked from commit 1b424c0178)

* gh-156002: Keep reading through monkey-patched zipfile decompressors (GH-157180) (GH-157557)
(cherry picked from commit f507e6946a)


Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: tonghuaroot <tonghuaroot@gmail.com>
Co-authored-by: rasmusfaber <rfaber@gmail.com>

2026-09-29 21:49:03 +00:00

..

_path

[3.13] gh-135276: Refresh zipfile.Path from zipp 3.23 (GH-135277) (#135279)

2025-06-08 17:56:35 -04:00

__init__.py

[3.13] gh-156002: Bound zipfile decompression for bzip2/LZMA (GH-156003) (GH-156362) (#156738)

2026-09-29 21:49:03 +00:00

__main__.py

gh-112578: Fix RuntimeWarning when running zipfile (GH-112579)

2023-12-03 13:09:29 +02:00