GeezerVison is showing github.com — gh-113977, gh-120754: Remove unbounded reads from zipfile (GH-122101) · python/cpython@556dc9b
File tree
Expand file treeCollapse file tree
Open diff view settings
Expand file treeCollapse file tree
Open diff view settings
Collapse file
Copy file name to clipboardExpand all lines: Lib/zipfile/__init__.py +3-3Lines changed: 3 additions & 3 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -309,7 +309,7 @@ def _EndRecData(fpin): |
309 | 309 | fpin.seek(-sizeEndCentDir, 2) |
310 | 310 | except OSError: |
311 | 311 | return None |
312 | | - data = fpin.read() |
| 312 | + data = fpin.read(sizeEndCentDir) |
313 | 313 | if (len(data) == sizeEndCentDir and |
314 | 314 | data[0:4] == stringEndArchive and |
315 | 315 | data[-2:] == b"\000\000"): |
@@ -329,9 +329,9 @@ def _EndRecData(fpin): |
329 | 329 | # record signature. The comment is the last item in the ZIP file and may be |
330 | 330 | # up to 64K long. It is assumed that the "end of central directory" magic |
331 | 331 | # number does not appear in the comment. |
332 | | - maxCommentStart = max(filesize - (1 << 16) - sizeEndCentDir, 0) |
| 332 | + maxCommentStart = max(filesize - ZIP_MAX_COMMENT - sizeEndCentDir, 0) |
333 | 333 | fpin.seek(maxCommentStart, 0) |
334 | | - data = fpin.read() |
| 334 | + data = fpin.read(ZIP_MAX_COMMENT + sizeEndCentDir) |
335 | 335 | start = data.rfind(stringEndArchive) |
336 | 336 | if start >= 0: |
337 | 337 | # found the magic number; attempt to unpack and interpret |
|
Collapse file
Copy file name to clipboard +1Lines changed: 1 addition & 0 deletions - Display the source diff
- Display the rich diff
| Original file line number | Diff line number | Diff line change |
|---|
|
| 1 | +Update unbounded ``read`` calls in :mod:`zipfile` to specify an explicit ``size`` putting a limit on how much data they may read. This also updates handling around ZIP max comment size to match the standard instead of reading comments that are one byte too long. |