journal: limit decompress_blob() output to DATA_SIZE_MAX (#41604)

We already have checks in place during compression that limit the data
we compress, so they shouldn't decompress to anything larger than
DATA_SIZE_MAX unless they've been tampered with. Let's make this
explicit and limit all our decompress_blob() calls in journal-handling
code to that limit.

One possible scenario this should prevent is when one tries to open and
verify a journal file that contains a compression bomb in its payload:

```
$ ls -lh test.journal
-rw-rw-r--+ 1 fsumsal fsumsal 1.2M Apr 12 15:07 test.journal

$ systemd-run --user --wait --pipe -- build-local/journalctl --verify --file=$PWD/test.journal
Running as unit: run-p682422-i4875779.service
000110: Invalid hash (00000000 vs. 11e4948d73bdafdd)
000110: Invalid object contents: Bad message
File corruption detected at /home/fsumsal/repos/@systemd/systemd/test.journal:272 (of 1249896 bytes, 0%).
FAIL: /home/fsumsal/repos/@systemd/systemd/test.journal (Bad message)
          Finished with result: exit-code
Main processes terminated with: code=exited, status=1/FAILURE
               Service runtime: 48.051s
             CPU time consumed: 47.941s
                   Memory peak: 8G (swap: 0B)
```
Same could be, in theory, possible with just `journalctl --file=`, but
the reproducer would be a bit more complicated (haven't tried it, yet).

Lastly, the change in journal-remote is mostly hardening, as the maximum
input size to decompress_blob() there is mandated by MHD's connection
memory limit (set to JOURNAL_SERVER_MEMORY_MAX which is 128 KiB at the
time of writing), so the possible output size there is already quite
limited (e.g. ~800 - 900 MiB for xz-compressed data).

This commit is contained in:

Zbigniew Jędrzejewski-Szmek

2026-04-13 12:02:11 +02:00

committed by

GitHub

parent 3e12cf85cd 31d360fb0b

commit d091b0dd6a

9 changed files with 22 additions and 20 deletions

									
										src/basic/compress.c
									
		+2
		
												View File
												
				@@ -757,6 +757,8 @@ static int decompress_blob_lz4(

				        size = unaligned_read_le64(src);

				        if (size < 0 || (unsigned) size != unaligned_read_le64(src))

				                return -EFBIG;

				        if (dst_max > 0 && (size_t) size > dst_max)

				                return -ENOBUFS;

				        out = greedy_realloc(dst, size, 1);

				        if (!out)

				                return -ENOMEM;