GNU bug report logs - #56247
inflate fails to reject invalid distance

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Young Mo Kang <kym327 <at> gmail.com>
Subject: bug#56247: closed (Re: bug#56247: inflate fails to reject invalid
 distance)
Date: Wed, 29 Jun 2022 03:46:01 +0000

[Message part 1 (text/plain, inline)]

Your bug report

#56247: inflate fails to reject invalid distance

which was filed against the gzip package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to 56247 <at> debbugs.gnu.org.

-- 
56247: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=56247
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: Paul Eggert <eggert <at> cs.ucla.edu>
To: "Adler, Mark" <madler <at> alumni.caltech.edu>
Cc: Young Mo Kang <kym327 <at> gmail.com>,
 GNU bug 56247 <56247-done <at> debbugs.gnu.org>
Subject: Re: bug#56247: inflate fails to reject invalid distance
Date: Tue, 28 Jun 2022 22:44:57 -0500

[Message part 3 (text/plain, inline)]

On 6/27/22 16:29, Adler, Mark wrote:
> Paul,
>
> gzip should reject invalid inflate input. The patch below does that.
>
Thanks for the quick patch. I installed that, along with Young Mo Kang's 
test case, as per the attached.

[0001-gzip-detect-invalid-input.patch (text/x-patch, attachment)]

[0002-gzip-test-invalid-input-bug.patch (text/x-patch, attachment)]

[Message part 6 (message/rfc822, inline)]

From: Young Mo Kang <kym327 <at> gmail.com>
To: bug-gzip <at> gnu.org
Subject: inflate fails to reject invalid distance
Date: Sun, 26 Jun 2022 20:21:09 -0700

Hello gzip devs and maintainers,

I noticed that GNU gzip does not check for error during decompression when the distance value exceeds the current accumulative position, i.e., back reference to position beyond the starting point.

The following shows an example .gz file with invalid distance

```
cat << EOF > file.gz.hex
1f8b0800000000000003738aca3034748c540b8ebc297129888141e1ffff
1f0c131842041818172b5c6169686068706438c0aad0c0c8c0e0c0c0d8e0
e8c0b1802124d94d81218571e1ab8c6f2b4c4dd9579830c82d7cc5c0ae72
e18bffefcab6244e0e4536861486f5e612abda4c336cf6dc5d5da4bd6c4d
ed49a13bffe37813164d39d8aafdb15c25b895937762afaa02c205deff85
c2181818a3241f30303031303231340830b0303032702e60306476b82035
6ff92b379ff625574ca6594d5a9cf7464ebf7ba7d21c0d0fd5ff9dda107f
000040136103cd000000
EOF

xxd -r -ps file.gz.hex | gzip -d > file
```

GNU gzip decompresses it w/o an error, while both macOS’s gzip and zlib reject the file and outputs an error:

macOS gzip: gzip: data stream error
zlib: <fd:0>: invalid distance too far back

I believe GNU gzip also needs to reject this file, since the file is not a valid deflate format.

Thanks,
Young

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.