Skip to content

gh-113977, gh-120754: Remove unbounded reads from zipfile#122101

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
gpshead merged 6 commits into from
Nov 3, 2024
Merged

gh-113977, gh-120754: Remove unbounded reads from zipfile #122101

gpshead merged 6 commits into from
Nov 3, 2024

Conversation

@cmaloney
Copy link
Contributor

@cmaloneycmaloney commented Jul 21, 2024•
edited by bedevere-app bot
Loading

Read without a size may read an unbounded amount of data + allocate unbounded size buffers. Move to capped size reads to prevent potential issues.

This is a followup #121593 (comment). I don't think this needs a separate news entry.

@cmaloney
pythonGH-120754: Remove unbounded reads from zipfile
1c1c5a3
Read without a size may read an unbounded amount of data + allocate unbounded size buffers. Move to capped size reads to prevent potential issues.
@bedevere-appbedevere-appbot mentioned this pull request Jul 21, 2024
Closed
@cmaloneycmaloney mentioned this pull request Jul 21, 2024
Closed
@picnixz
Copy link
Member

picnixz commented Jul 22, 2024•
edited
Loading

Ah maybe not a skip news actually. I'll leave the decision to someone else.

picnixz
picnixz reviewed Jul 22, 2024
View reviewed changes
danifus
danifus reviewed Jul 22, 2024
View reviewed changes
cmaloneyand others added 2 commits July 22, 2024 11:33
@cmaloney@danifus
Update Lib/zipfile/__init__.py
08cdd79
Co-authored-by: Daniel Hillier <daniel.hillier@gmail.com>
@cmaloney@danifus
Update Lib/zipfile/__init__.py
8961b0b
Co-authored-by: Daniel Hillier <daniel.hillier@gmail.com>
cmaloneyand others added 2 commits July 22, 2024 19:16
@cmaloney@danifus
Don't require reading an EOF
6dc8a0b
 The seek just before this _should_ result in this read hitting EOF here or getting less bytes. Co-authored-by: Daniel Hillier <daniel.hillier@gmail.com>
@blurb-it
📜🤖 Added by blurb_it.
0d6151e
@danifusdanifus mentioned this pull request Aug 5, 2024
Closed
@cmaloneycmaloney changed the title GH-120754: Remove unbounded reads from zipfilegh-113977, gh-120754: Remove unbounded reads from zipfileSep 10, 2024
@cmaloneycmaloney mentioned this pull request Sep 18, 2024
Merged
@gpsheadgpshead merged commit 556dc9b into python:mainNov 3, 2024
@gpsheadgpshead added needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes labels Nov 3, 2024
@miss-islington-app
Copy link

miss-islington-appbot commented Nov 3, 2024

Thanks @cmaloney for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

@miss-islington-app
Copy link

miss-islington-appbot commented Nov 3, 2024

Thanks @cmaloney for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Nov 3, 2024
@cmaloney@danifus
@blurb-it@miss-islington
pythongh-113977,pythongh-120754: Remove unbounded reads from zipfile (…
7ea6fd2
…pythonGH-122101) pythonGH-113977, pythonGH-120754: Remove unbounded reads from zipfile Read without a size may read an unbounded amount of data + allocate unbounded size buffers. Move to capped size reads to prevent potential issues. (cherry picked from commit 556dc9b) Co-authored-by: Cody Maloney <cmaloney@users.noreply.github.com> Co-authored-by: Daniel Hillier <daniel.hillier@gmail.com> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Nov 3, 2024
@cmaloney@danifus
@blurb-it@miss-islington
pythongh-113977,pythongh-120754: Remove unbounded reads from zipfile (…
f17af1e
…pythonGH-122101) pythonGH-113977, pythonGH-120754: Remove unbounded reads from zipfile Read without a size may read an unbounded amount of data + allocate unbounded size buffers. Move to capped size reads to prevent potential issues. (cherry picked from commit 556dc9b) Co-authored-by: Cody Maloney <cmaloney@users.noreply.github.com> Co-authored-by: Daniel Hillier <daniel.hillier@gmail.com> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
@bedevere-app
Copy link

bedevere-appbot commented Nov 3, 2024

GH-126347 is a backport of this pull request to the 3.12 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.12 only security fixes label Nov 3, 2024
@bedevere-app
Copy link

bedevere-appbot commented Nov 3, 2024

GH-126348 is a backport of this pull request to the 3.13 branch.

@bedevere-appbedevere-appbot removed the needs backport to 3.13 bugs and security fixes label Nov 3, 2024
@cmaloneycmaloney deleted the cmaloney/zipfile_tweaks branch November 3, 2024 05:46
gpshead pushed a commit that referenced this pull request Nov 3, 2024
@miss-islington@cmaloney
@danifus@blurb-it
[3.12]gh-113977,gh-120754: Remove unbounded reads from zipfile (GH-…
6e3e91f
…122101) (#126347) gh-113977, gh-120754: Remove unbounded reads from zipfile (GH-122101) GH-113977, GH-120754: Remove unbounded reads from zipfile Read without a size may read an unbounded amount of data + allocate unbounded size buffers. Move to capped size reads to prevent potential issues. (cherry picked from commit 556dc9b) Co-authored-by: Cody Maloney <cmaloney@users.noreply.github.com> Co-authored-by: Daniel Hillier <daniel.hillier@gmail.com> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
gpshead pushed a commit that referenced this pull request Nov 3, 2024
@miss-islington@cmaloney
@danifus@blurb-it
[3.13]gh-113977,gh-120754: Remove unbounded reads from zipfile (GH-…
7435127
…122101) (#126348) gh-113977, gh-120754: Remove unbounded reads from zipfile (GH-122101) GH-113977, GH-120754: Remove unbounded reads from zipfile Read without a size may read an unbounded amount of data + allocate unbounded size buffers. Move to capped size reads to prevent potential issues. (cherry picked from commit 556dc9b) Co-authored-by: Cody Maloney <cmaloney@users.noreply.github.com> Co-authored-by: Daniel Hillier <daniel.hillier@gmail.com> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
picnixz pushed a commit to picnixz/cpython that referenced this pull request Dec 8, 2024
@cmaloney@danifus
@blurb-it@picnixz
pythongh-113977,pythongh-120754: Remove unbounded reads from zipfile (…
b7046ab
…pythonGH-122101) pythonGH-113977, pythonGH-120754: Remove unbounded reads from zipfile Read without a size may read an unbounded amount of data + allocate unbounded size buffers. Move to capped size reads to prevent potential issues. Co-authored-by: Daniel Hillier <daniel.hillier@gmail.com> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
ebonnal pushed a commit to ebonnal/cpython that referenced this pull request Jan 12, 2025
@cmaloney@danifus
@blurb-it@ebonnal
pythongh-113977,pythongh-120754: Remove unbounded reads from zipfile (…
22db78f
…pythonGH-122101) pythonGH-113977, pythonGH-120754: Remove unbounded reads from zipfile Read without a size may read an unbounded amount of data + allocate unbounded size buffers. Move to capped size reads to prevent potential issues. Co-authored-by: Daniel Hillier <daniel.hillier@gmail.com> Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@picnixzpicnixzpicnixz left review comments

@gpsheadgpsheadgpshead approved these changes

+1 more reviewer

@danifusdanifusdanifus approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@cmaloney@picnixz@gpshead@danifus