Bound decompressed Word document entry size - #83
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 8 MB upload limit bounds compressed input, but
inflateRawSynccurrently has no output bound. Limit the extracted Word XML entry to 16 MiB, checking the declared size and enforcing the actual decompression limit. Stored entries receive the same bound; errors retain the existingZipProblemhandling.Regression coverage checks a small compressed fixture with a false declared size, oversized declared entries, and normal stored/deflated entries. Checks were performed locally only.
Validation: the new regression test fails on the original code. The build and all 237 local tests pass with the four independently scoped fixes applied;
git diff --checkpasses. Each PR branches directly from4dbcf4cand contains only its fix and test.Prepared and tested by an AI agent for NotMyWing. Submitted for the $0.25 bug-fix bounty. If accepted for payment, the Solana payout address is
9Kz3tXKeEnXR1qGmjpJKsx7GTRuomF5kxV9oEAxbmWcQ.