From 87e8e270d128a99144f11ee9187ec60d5e9dc5e8 Mon Sep 17 00:00:00 2001 From: dmiller Date: Wed, 1 Jul 2026 02:06:11 +0000 Subject: [PATCH] Add an output limit for zlib.decompress --- nse_zlib.cc | 14 ++++++++++---- nselib/zlib.luadoc | 3 ++- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/nse_zlib.cc b/nse_zlib.cc index 7641fc2bf..26c996a3d 100644 --- a/nse_zlib.cc +++ b/nse_zlib.cc @@ -817,6 +817,7 @@ static int lzlib_decompress(lua_State *L) size_t avail_in; const char *next_in = luaL_checklstring(L, 1, &avail_in); int windowBits = (int) luaL_optinteger(L, 2, 15); + int decompLimit = (int) luaL_optinteger(L, 3, 10*1024*1024); int ret; luaL_Buffer b; @@ -842,15 +843,20 @@ static int lzlib_decompress(lua_State *L) zs.next_in = (unsigned char*)next_in; zs.avail_in = avail_in; - for (;;) { - zs.next_out = (unsigned char*)luaL_prepbuffer(&b); - zs.avail_out = LUAL_BUFFERSIZE; + while(decompLimit > 0) { + unsigned int bufsize = LUAL_BUFFERSIZE; + if (bufsize > decompLimit) + bufsize = decompLimit; + zs.next_out = (unsigned char*)luaL_prepbuffsize(&b, bufsize); + zs.avail_out = bufsize; /* bake some more */ ret = inflate(&zs, Z_FINISH); /* push gathered data */ - luaL_addsize(&b, LUAL_BUFFERSIZE - zs.avail_out); + unsigned int inflatesize = bufsize - zs.avail_out; + luaL_addsize(&b, inflatesize); + decompLimit -= inflatesize; /* done processing? */ if (ret == Z_STREAM_END) diff --git a/nselib/zlib.luadoc b/nselib/zlib.luadoc index 2148896bc..ffd97e9fd 100644 --- a/nselib/zlib.luadoc +++ b/nselib/zlib.luadoc @@ -52,7 +52,8 @@ function compress(buffer, level, method, windowBits, memLevel, strategy) -- If windowBits is negative, this function decompresses raw deflate data without header. -- @param buffer String containing DEFLATE-compressed data -- @param windowBits Optional integer, the base-2 logarithm of the maximum window size. Default: 15 -function decompress(buffer, windowBits) +-- @param decompLimit Optional integer, the maximum number of bytes to inflate. Default: 10MiB +function decompress(buffer, windowBits, decompLimit) --- Return a deflate stream. --