compress: fix unbounded buffer growth on truncated streams, and fuzz the decompressors (#43589)

2026-09-02 19:59:51 +09:00
parent 25c0b10671 65c112007a
commit 26f4d56015
13 changed files with 221 additions and 0 deletions
@@ -1440,6 +1440,9 @@ static int decompress_startswith_gzip(
                if (r == Z_STREAM_END)
                        return 0;

+                if (s.avail_out > 0)
+                        return -EBADMSG; /* truncated */
+
                size_t used = allocated - s.avail_out;

                if (!(greedy_realloc(buffer, allocated * 2, 1)))
@@ -1506,6 +1509,9 @@ static int decompress_startswith_bzip2(
                if (r == BZ_STREAM_END)
                        return 0;

+                if (s.avail_out > 0)
+                        return -EBADMSG; /* truncated */
+
                size_t used = allocated - s.avail_out;

                if (!(greedy_realloc(buffer, allocated * 2, 1)))