Description

maurycy

opened on Aug 8, 2025

Issue body actions

Bug report

Bug description:

This one is easy to spot but hard to reproduce:

cpython/Lib/gzip.py

Line 589 in d7dbde8

if buf == b"":

buf is initialized only when self._decompressor.needs_input:

cpython/Lib/gzip.py

Line 577 in d7dbde8

buf = self._fp.read(READ_BUFFER_SIZE)

It exists since gh-95534 (#97664).

I spent a lot of time trying to reproduce this bug using the standard zlib decompressor without any success:

import gzip
import io

class EvilDecomp:
    def __init__(self, **kwargs):
        self.needs_input = False
        self.unused_data = b""
        self.eof = False
    def decompress(self, data, max_length):
        self.needs_input = True
        return b""

gzip.zlib._ZlibDecompressor = EvilDecomp

with gzip.GzipFile(
    fileobj=io.BytesIO(gzip.compress(b"hello world")), mode="rb"
) as f:
    f.read(1)

results in:

22:16:40.678647000PM CEST maurycy@gimel /Users/maurycy/src/cpython % ./python.exe meow.py
Traceback (most recent call last):
  File "/Users/maurycy/src/cpython/meow.py", line 18, in <module>
    f.read(1)
    ~~~~~~^^^
  File "/Users/maurycy/src/cpython/Lib/gzip.py", line 349, in read
    return self._buffer.read(size)
           ~~~~~~~~~~~~~~~~~^^^^^^
  File "/Users/maurycy/src/cpython/Lib/compression/_common/_streams.py", line 68, in readinto
    data = self.read(len(byte_view))
  File "/Users/maurycy/src/cpython/Lib/gzip.py", line 589, in read
    if buf == b"":
       ^^^
UnboundLocalError: cannot access local variable 'buf' where it is not associated with a value

CPython versions tested on:

CPython main branch

Operating systems tested on:

macOS

Linked PRs

• gh-137571: Fix UnboundLocalError in gzip._GzipReader.read() #137572
• gh-137571: Protect against possible UnboundLocalError in gzip._GzipReader.read() #150222
• [3.15] gh-137571: Protect against possible UnboundLocalError in gzip._GzipReader.read() (GH-150222) #150229
• [3.14] gh-137571: Protect against possible UnboundLocalError in gzip._GzipReader.read() (GH-150222) #150230
• [3.13] gh-137571: Protect against possible UnboundLocalError in gzip._GzipReader.read() (GH-150222) #150231

Activity

1. maurycy

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Aug 8, 2025
2. picnixz

   added

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   on Aug 8, 2025
3. ZeroIntensity commented on Aug 9, 2025

   

   ZeroIntensity

   on Aug 9, 2025

   Member

   More actions

   Just for clarification, does this cause an actual problem in practice? The fix seems simple enough that it's probably worth doing, but I want to make sure this isn't just from fuzzing the private API.

   Reacted by Serhiy Storchaka
4. maurycy commented on Aug 9, 2025

   

   maurycy

   on Aug 9, 2025

   ContributorAuthor

   More actions

   @ZeroIntensity Nope! Neither. I was reviewing various modules to see how similar are different stream implementations across the stdlib. Many classes provide streaming. They employ different strategies (some copy, some use memoryview etc.) but overlap, and I was curious if there's any opportunity to contribute. That's how I found gh-137524 also.
5. serhiy-storchaka

   added this to Compression issues 🗜on May 20, 2026
6. serhiy-storchaka

   added a commit that references this issue on May 22, 2026

   gh-137571: Protect against possible UnboundLocalError in gzip._GzipRe…

   28eac9a
7. serhiy-storchaka commented on May 22, 2026

   

   serhiy-storchaka

   on May 22, 2026

   Member

   More actions

   Thank you for your report @maurycy.

   Reacted by Maurycy Pawłowski-Wieroński
8. serhiy-storchaka

   closed this as completedon May 22, 2026
9. github-project-automation

   moved this to Done in Compression issues 🗜on May 22, 2026
10. serhiy-storchaka

    added

    3.13only security fixesonly security fixes

    3.14bugs and security fixesbugs and security fixes

    3.15bugs and security fixesbugs and security fixes

    3.16new features, bugs and security fixesnew features, bugs and security fixes

    on May 22, 2026
11. serhiy-storchaka

    added 3 commits that reference this issue on May 22, 2026

    [3.13] gh-137571: Protect against possible UnboundLocalError in gzip.…

    46cff6b

    [3.14] gh-137571: Protect against possible UnboundLocalError in gzip.…

    58a3681

    [3.15] gh-137571: Protect against possible UnboundLocalError in gzip.…

    e192a0e
12. grantlouisherman

    added 2 commits that reference this issue on May 22, 2026

    pythongh-137571: Protect against possible UnboundLocalError in gzip._…

    0f84205

    pythongh-137571: Protect against possible UnboundLocalError in gzip._…

    41f1cdc

Issue actions