projects / ostree.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: ae08c55) | patch
static-delta: Add resource limits for LZMA decompression
authorJoseph Marrero Corchado <jmarrero@redhat.com>
Tue, 28 Jul 2026 18:15:56 +0000 (14:15 -0400)
committerJoseph Marrero Corchado <jmarrero@redhat.com>
Tue, 28 Jul 2026 18:15:56 +0000 (14:15 -0400)
commit7d1c30b2d73caf80ae09e571b4e844afe3610fbc
treeccdbaa73587399f2d82d611d1b7abfb04b1c6009tree | snapshot
parentae08c555201ec382ed8ae4fc118e7a714cbb32bbcommit | diff
static-delta: Add resource limits for LZMA decompression

A malicious repository can serve crafted static delta content that
exhausts client memory and disk during ostree pull before checksum
validation completes.

Cap the LZMA decoder memory to 100 MiB (matching RPM's default) and
bound decompressed delta part output to 512 MiB. The size limit is
enforced on both compressed and uncompressed code paths.

Closes: RHEL-189208
Makefile-tests.am diff | blob | history
src/libostree/ostree-lzma-decompressor.c diff | blob | history
src/libostree/ostree-repo-static-delta-core.c diff | blob | history
src/libostree/ostree-repo-static-delta-private.h diff | blob | history
src/libotutil/ot-fs-utils.c diff | blob | history
src/libotutil/ot-fs-utils.h diff | blob | history
tests/test-lzma.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.