[PR] avoid unbounded recursion on empty frames in framed lz4 and snappy decoders [commons-compress]

["kali834x (via GitHub)" <gi...@apache.org>]

kali834x opened a new pull request, #803:
URL: https://github.com/apache/commons-compress/pull/803

   framedlz4compressorinputstream.nextblock and framedsnappycompressorinputstream.readnextblock advance past zero-output units by recursing rather than looping: nextblock reaches an lz4 endmark and calls init, which reads the next frame and calls nextblock again, once per empty concatenated frame; readnextblock calls itself again after every snappy stream-identifier and padding/skippable chunk. those units are all legal per the respective frame specs, so the recursion depth is just the attacker-controlled count of them. a stream of a few hundred kb of empty frames or padding chunks overflows the stack with stackoverflowerror out of read and the framedlz4 constructor, which declare only throws ioexception, so a caller catching ioexception to handle a corrupt stream gets an error instead. both paths are turned into a while loop that advances over the empty units without growing the stack; valid streams decode exactly as before. regression tests in both decoders build ~200k empty units 
 and assert the stream now reads to eof.
   
   - [x] Read the [contribution guidelines](CONTRIBUTING.md) for this project.
   - [ ] Read the [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html) if you use Artificial Intelligence (AI).
   - [ ] I used AI to create any part of, or all of, this pull request. Which AI tool was used to create this pull request, and to what extent did it contribute?
   - [x] Run a successful build using the default [Maven](https://maven.apache.org/) goal with `mvn`; that's `mvn` on the command line by itself.
   - [x] Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied. This may not always be possible, but it is a best practice.
   - [x] Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
   - [x] Each commit in the pull request should have a meaningful subject line and body. Note that a maintainer may squash commits during the merge process.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Avoid unbounded recursion on empty frames in framed lz4 and snappy decoders [commons-compress]

["garydgregory (via GitHub)" <gi...@apache.org>]

garydgregory merged PR #803:
URL: https://github.com/apache/commons-compress/pull/803


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org