Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

lzma._decode_filter_properties crashes with BCJ filter and buffer of zero length #104282

Closed
Labels
3.11only security fixes3.12only security fixes3.13bugs and security fixesstdlibStandard Library Python modules in the Lib/ directorytype-crashA hard crash of the interpreter, possibly with a core dump
@chgnrdv

Description

@chgnrdv

Example:

>>>importlzma>>>lzma._decode_filter_properties(lzma.FILTER_X86,b"")Segmentationfault (coredumped)

In_lzma__decode_filter_properties_impl call tolzma_properties_decode returnsLZMA_OK and leavesfilter.options intact (that is uninitialized) iffilter.id is id of a BCJ filter (FILTER_X86, FILTER_POWERPC, FILTER_IA64, FILTER_ARM, FILTER_ARMTHUMB, FILTER_SPARC) andencoded_props->len is equal to zero.

lzret=lzma_properties_decode(
&filter,NULL,encoded_props->buf,encoded_props->len);
if (catch_lzma_error(state,lzret)) {
returnNULL;
}
result=build_filter_spec(&filter);

Then, inbuild_filter_spec, access tof->options->start_offset leads to segmentation fault:

}
caseLZMA_FILTER_X86:
caseLZMA_FILTER_POWERPC:
caseLZMA_FILTER_IA64:
caseLZMA_FILTER_ARM:
caseLZMA_FILTER_ARMTHUMB:
caseLZMA_FILTER_SPARC: {
lzma_options_bcj*options=f->options;
ADD_FIELD(options,start_offset);
break;
}

The PR is on the way.
3.9-3.12 are affected for sure.

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.11only security fixes3.12only security fixes3.13bugs and security fixesstdlibStandard Library Python modules in the Lib/ directorytype-crashA hard crash of the interpreter, possibly with a core dump

    Projects

    Status

    Done

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions


      [8]ページ先頭

      ©2009-2025 Movatter.jp