python / python/cpython

Keep next_in and avail_in in sync in bz2/lzma/zlib decompressor reset paths

Open
#149,105 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

extension-modules type-refactor
Dominant language
Python
Stars
77.2k
Forks
35.9k
PR merge metrics
PR metrics pending

Description

Bug report

Bug description:

(This was found by Gemini, orchestrated by Dirk Mueller at SUSE)

For https://github.com/advisories/GHSA-pg25-7cx5-cvcm the "next_in" pointers were reset to NULL. However if the decompressor is reused, the "avail_in_real" counter should also be reset to "0" at this time, as if its reused again, next_in and avail_in_real might not be in sync again.

This affects

Modules/_bz2module.c
Modules/_lzmamodule.c
Modules/zlibmodule.c

For bz2, everywhere where next_in is set to NULL, avail_in_real also needs to be set to 0.

++ bzs->next_in = NULL;
should also set
bzs->avail_in_real = 0;

similar for the others.

This is largely hardening. It is not clear if these use cases exist.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Review the reset paths in Modules/_bz2module.c, Modules/_lzmamodule.c, and Modules/zlibmodule.c, locating every assignment that sets next_in to NULL. Confirm that each such reset also clears avail_in_real, then run the relevant decompressor tests and verify the reused decompressor state remains synchronized.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, python
Domain
backend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
62/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.