Skip to content

gh-113977, gh-120754: Remove unbounded reads from zipfile - #122101

Merged
gpshead merged 6 commits into
python:mainfrom
cmaloney:cmaloney/zipfile_tweaks
Nov 3, 2024
Merged

gh-113977, gh-120754: Remove unbounded reads from zipfile#122101
gpshead merged 6 commits into
python:mainfrom
cmaloney:cmaloney/zipfile_tweaks

Conversation

@cmaloney

@cmaloney cmaloney commented Jul 21, 2024 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Contributor

Read without a size may read an unbounded amount of data + allocate unbounded size buffers. Move to capped size reads to prevent potential issues.

This is a followup #121593 (comment). I don't think this needs a separate news entry.
@cmaloney
pythonGH-120754: Remove unbounded reads from zipfile
1c1c5a3 
Read without a size may read an unbounded amount of data + allocate
unbounded size buffers. Move to capped size reads to prevent potential
issues.
@bedevere-app bedevere-app Bot mentioned this pull request Jul 21, 2024
Closed
@cmaloney cmaloney mentioned this pull request Jul 21, 2024
Closed
@picnixz

picnixz commented Jul 22, 2024 •
edited
Loading

Copy link
Copy Markdown
Member

Ah maybe not a skip news actually. I'll leave the decision to someone else.
@picnixz picnixz removed the skip news label Jul 22, 2024
picnixz
picnixz reviewed Jul 22, 2024
View reviewed changes
Comment thread Lib/zipfile/__init__.py Outdated
danifus
danifus reviewed Jul 22, 2024
View reviewed changes
Comment thread Lib/zipfile/__init__.py Outdated
Comment thread Lib/zipfile/__init__.py Outdated
Comment thread Lib/zipfile/__init__.py Outdated
cmaloney and others added 2 commits July 22, 2024 11:33
@cmaloney @danifus
Update Lib/zipfile/__init__.py
08cdd79 
Co-authored-by: Daniel Hillier <daniel.hillier@gmail.com>
@cmaloney @danifus
Update Lib/zipfile/__init__.py
8961b0b 
Co-authored-by: Daniel Hillier <daniel.hillier@gmail.com>
cmaloney and others added 2 commits July 22, 2024 19:16
@cmaloney @danifus
Don't require reading an EOF
6dc8a0b 
The seek just before this _should_ result in this read hitting EOF here or getting less bytes.

Co-authored-by: Daniel Hillier <daniel.hillier@gmail.com>
@blurb-it
📜🤖 Added by blurb_it.
0d6151e
@danifus danifus mentioned this pull request Aug 5, 2024
Closed
@cmaloney cmaloney changed the title GH-120754: Remove unbounded reads from zipfile Sep 10, 2024
@cmaloney cmaloney mentioned this pull request Sep 18, 2024
Merged
@gpshead
gpshead merged commit 556dc9b into python:main Nov 3, 2024
@gpshead gpshead added needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes labels Nov 3, 2024
@miss-islington-app

miss-islington-app Bot commented Nov 3, 2024

Copy link
Copy Markdown

Thanks @cmaloney for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖
@miss-islington-app

miss-islington-app Bot commented Nov 3, 2024

Copy link
Copy Markdown

Thanks @cmaloney for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Nov 3, 2024
@cmaloney @danifus
@blurb-it @miss-islington
pythongh-113977, pythongh-120754: Remove unbounded reads from zipfile (…
7ea6fd2 
…pythonGH-122101)

pythonGH-113977, pythonGH-120754: Remove unbounded reads from zipfile

Read without a size may read an unbounded amount of data + allocate
unbounded size buffers. Move to capped size reads to prevent potential
issues.

(cherry picked from commit 556dc9b)

Co-authored-by: Cody Maloney <cmaloney@users.noreply.github.com>
Co-authored-by: Daniel Hillier <daniel.hillier@gmail.com>
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Nov 3, 2024
@cmaloney @danifus
@blurb-it @miss-islington
pythongh-113977, pythongh-120754: Remove unbounded reads from zipfile (…
f17af1e 
…pythonGH-122101)

pythonGH-113977, pythonGH-120754: Remove unbounded reads from zipfile

Read without a size may read an unbounded amount of data + allocate
unbounded size buffers. Move to capped size reads to prevent potential
issues.

(cherry picked from commit 556dc9b)

Co-authored-by: Cody Maloney <cmaloney@users.noreply.github.com>
Co-authored-by: Daniel Hillier <daniel.hillier@gmail.com>
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
@bedevere-app

bedevere-app Bot commented Nov 3, 2024

Copy link
Copy Markdown

GH-126347 is a backport of this pull request to the 3.12 branch.
@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Nov 3, 2024
@bedevere-app

bedevere-app Bot commented Nov 3, 2024

Copy link
Copy Markdown

GH-126348 is a backport of this pull request to the 3.13 branch.
@bedevere-app bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label Nov 3, 2024
@cmaloney
cmaloney deleted the cmaloney/zipfile_tweaks branch November 3, 2024 05:46
gpshead pushed a commit that referenced this pull request Nov 3, 2024
@miss-islington @cmaloney
@danifus @blurb-it
[3.12] gh-113977, gh-120754: Remove unbounded reads from zipfile (GH-…
6e3e91f 
…122101) (#126347)

gh-113977, gh-120754: Remove unbounded reads from zipfile (GH-122101)

GH-113977, GH-120754: Remove unbounded reads from zipfile

Read without a size may read an unbounded amount of data + allocate
unbounded size buffers. Move to capped size reads to prevent potential
issues.

(cherry picked from commit 556dc9b)

Co-authored-by: Cody Maloney <cmaloney@users.noreply.github.com>
Co-authored-by: Daniel Hillier <daniel.hillier@gmail.com>
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
gpshead pushed a commit that referenced this pull request Nov 3, 2024
@miss-islington @cmaloney
@danifus @blurb-it
[3.13] gh-113977, gh-120754: Remove unbounded reads from zipfile (GH-…
7435127 
…122101) (#126348)

gh-113977, gh-120754: Remove unbounded reads from zipfile (GH-122101)

GH-113977, GH-120754: Remove unbounded reads from zipfile

Read without a size may read an unbounded amount of data + allocate
unbounded size buffers. Move to capped size reads to prevent potential
issues.

(cherry picked from commit 556dc9b)

Co-authored-by: Cody Maloney <cmaloney@users.noreply.github.com>
Co-authored-by: Daniel Hillier <daniel.hillier@gmail.com>
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
picnixz pushed a commit to picnixz/cpython that referenced this pull request Dec 8, 2024
@cmaloney @danifus
@blurb-it @picnixz
pythongh-113977, pythongh-120754: Remove unbounded reads from zipfile (…
b7046ab 
…pythonGH-122101)

pythonGH-113977, pythonGH-120754: Remove unbounded reads from zipfile

Read without a size may read an unbounded amount of data + allocate
unbounded size buffers. Move to capped size reads to prevent potential
issues.

Co-authored-by: Daniel Hillier <daniel.hillier@gmail.com>
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
ebonnal pushed a commit to ebonnal/cpython that referenced this pull request Jan 12, 2025
@cmaloney @danifus
@blurb-it @ebonnal
pythongh-113977, pythongh-120754: Remove unbounded reads from zipfile (…
22db78f 
…pythonGH-122101)

pythonGH-113977, pythonGH-120754: Remove unbounded reads from zipfile

Read without a size may read an unbounded amount of data + allocate
unbounded size buffers. Move to capped size reads to prevent potential
issues.

Co-authored-by: Daniel Hillier <daniel.hillier@gmail.com>
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
@coderabbitai coderabbitai Bot mentioned this pull request May 9, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

4 participants

@cmaloney @picnixz @gpshead @danifus