Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

archive/zip: malformed archive may cause panic or memory exhaustion [1.15 backport] #46396

Closed
gopherbot opened this issue May 26, 2021 · 3 comments
Closed

archive/zip: malformed archive may cause panic or memory exhaustion [1.15 backport] #46396

gopherbot opened this issue May 26, 2021 · 3 comments
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge release-blocker Security
Milestone
Go1.15.13

Comments

@gopherbot
Copy link

@rolandshoemaker requested issue #46242 to be considered for backport to the next 1.15 minor release.

@gopherbot please consider this for backport to 1.15 and 1.16 as this is a security issue.
@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label May 26, 2021
@gopherbot gopherbot mentioned this issue May 26, 2021
Closed
@gopherbot gopherbot added this to the Go1.15.13 milestone May 26, 2021
@gopherbot
Copy link
Author

Change https://golang.org/cl/322949 mentions this issue: [release-branch.go1.15] archive/zip: only preallocate File slice if reasonably sized

@mknyszek mknyszek added the CherryPickApproved Used during the release process for point releases label May 26, 2021
@mknyszek
Copy link
Contributor

A security issue with no workaround because it's in a library detail. Approved.

@gopherbot gopherbot removed the CherryPickCandidate Used during the release process for point releases label May 26, 2021
@gopherbot
Copy link
Author

Closed by merging c92adf4 to release-branch.go1.15.

gopherbot pushed a commit that referenced this issue May 28, 2021
@rolandshoemaker @katiehockman
[release-branch.go1.15] archive/zip: only preallocate File slice if r…
c92adf4 
…easonably sized

Since the number of files in the EOCD record isn't validated, it isn't
safe to preallocate Reader.Files using that field. A malformed archive
can indicate it contains up to 1 << 128 - 1 files. We can still safely
preallocate the slice by checking if the specified number of files in
the archive is reasonable, given the size of the archive.

Thanks to the OSS-Fuzz project for discovering this issue and to
Emmanuel Odeke for reporting it.

Updates #46242
Fixes #46396
Fixes CVE-2021-33196

Change-Id: I3c76d8eec178468b380d87fdb4a3f2cb06f0ee76
Reviewed-on: https://go-review.googlesource.com/c/go/+/318909
Trust: Roland Shoemaker <roland@golang.org>
Trust: Katie Hockman <katie@golang.org>
Trust: Joe Tsai <thebrokentoaster@gmail.com>
Run-TryBot: Roland Shoemaker <roland@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
Reviewed-by: Joe Tsai <thebrokentoaster@gmail.com>
(cherry picked from commit 74242ba)
Reviewed-on: https://go-review.googlesource.com/c/go/+/322949
Reviewed-by: Filippo Valsorda <filippo@golang.org>
@golang golang locked and limited conversation to collaborators May 28, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge release-blocker Security
Projects
None yet
Milestone
Go1.15.13
Development

No branches or pull requests
3 participants
@FiloSottile @mknyszek @gopherbot