]> dgit.raspbian.org Git - dovecot.git/commit
[PATCH 2/4] lib-compression: Iterate instead of recursing on zero-output decompress...
authorAki Tuomi <aki.tuomi@open-xchange.com>
Wed, 10 Jun 2026 11:54:00 +0000 (11:54 +0000)
committerNoah Meyerhans <noahm@debian.org>
Wed, 16 Sep 2026 19:06:35 +0000 (15:06 -0400)
commit361c9d3c790ade51499924ff127123e8d0204d91
tree120c3cb19c669594386dbde4b0b1e8f3261c225d
parent0467d0d8917ffd636f937023618c229d53c3384b
[PATCH 2/4] lib-compression: Iterate instead of recursing on zero-output decompress chunks

istream-lz4, istream-zlib and istream-bzlib each retried a read that
produced no output by tail-calling their own read function. A crafted
compressed stream can contain an unbounded number of chunks/steps that
each decompress to zero bytes - e.g. an lz4 stream of single-byte chunks
that each decode to nothing - so an attacker controlling the compressed
data can drive recursion depth proportional to the chunk count. Tail-call
optimization is not guaranteed, so this can exhaust the stack and crash
the process reading the stream.

Replace the recursive calls with continue inside the for(;;) loop
introduced in the previous commit, keeping stack usage O(1). Add a
regression test that feeds istream-lz4 a stream of 100000 empty chunks
and reads it in a single call.

Gbp-Pq: Name 0002-lib-compression-Iterate-instead-of-recursing-on-zero.patch
src/lib-compression/istream-bzlib.c
src/lib-compression/istream-lz4.c
src/lib-compression/istream-zlib.c
src/lib-compression/test-compression.c