Add protection against decompression bomb for bz2, gz, zip, and tar

essentialkaos · Sep 24, 2024 · f152df9 · f152df9
1 parent 4a50945
commit f152df9
Show file tree

Hide file tree

Showing 4 changed files with 26 additions and 4 deletions.
diff --git a/bz2/bz2.go b/bz2/bz2.go
@@ -22,6 +22,12 @@ import (
 
 // ////////////////////////////////////////////////////////////////////////////////// //
 
+// MaxReadLimit is the maximum read limit for decompression bomb
+// protection (default: 1GB)
+var MaxReadLimit int64 = 1024 * 1024 * 1024
+
+// ////////////////////////////////////////////////////////////////////////////////// //
+
 var (
 	ErrNilReader   = fmt.Errorf("Reader can not be nil")
 	ErrEmptyInput  = fmt.Errorf("Path to input file can not be empty")
@@ -76,7 +82,7 @@ func Read(r io.Reader, output string) error {
 	}
 
 	bw := bufio.NewWriter(fd)
-	_, err = io.Copy(bw, bzip2.NewReader(r))
+	_, err = io.Copy(bw, io.LimitReader(bzip2.NewReader(r), MaxReadLimit))
 
 	bw.Flush()
 	fd.Close()

diff --git a/gz/gz.go b/gz/gz.go
@@ -23,6 +23,12 @@ import (
 
 // ////////////////////////////////////////////////////////////////////////////////// //
 
+// MaxReadLimit is the maximum read limit for decompression bomb
+// protection (default: 1GB)
+var MaxReadLimit int64 = 1024 * 1024 * 1024
+
+// ////////////////////////////////////////////////////////////////////////////////// //
+
 var (
 	ErrNilReader   = fmt.Errorf("Reader can not be nil")
 	ErrEmptyInput  = fmt.Errorf("Path to input file can not be empty")
@@ -83,7 +89,7 @@ func Read(r io.Reader, output string) error {
 	}
 
 	bw := bufio.NewWriter(fd)
-	_, err = io.Copy(bw, cr)
+	_, err = io.Copy(bw, io.LimitReader(cr, MaxReadLimit))
 
 	bw.Flush()
 	fd.Close()

diff --git a/tar/tar.go b/tar/tar.go
@@ -32,6 +32,10 @@ var UpdateTimes = true
 // outside target directory
 var AllowExternalLinks = false
 
+// MaxReadLimit is the maximum read limit for decompression bomb
+// protection (default: 1GB)
+var MaxReadLimit int64 = 1024 * 1024 * 1024
+
 // ////////////////////////////////////////////////////////////////////////////////// //
 
 var (
@@ -148,7 +152,7 @@ func createFile(h *tar.Header, r io.Reader, path string) error {
 	}
 
 	bw := bufio.NewWriter(fd)
-	_, err = io.Copy(bw, r)
+	_, err = io.Copy(bw, io.LimitReader(r, MaxReadLimit))
 
 	if err != nil {
 		return err

diff --git a/zip/zip.go b/zip/zip.go
@@ -22,6 +22,12 @@ import (
 
 // ////////////////////////////////////////////////////////////////////////////////// //
 
+// MaxReadLimit is the maximum read limit for decompression bomb
+// protection (default: 1GB)
+var MaxReadLimit int64 = 1024 * 1024 * 1024
+
+// ////////////////////////////////////////////////////////////////////////////////// //
+
 var (
 	ErrNilReader   = fmt.Errorf("Reader can not be nil")
 	ErrEmptyOutput = fmt.Errorf("Path to output directory can not be empty")
@@ -95,7 +101,7 @@ func Read(r io.ReaderAt, dir string) error {
 		}
 
 		bw := bufio.NewWriter(fd)
-		_, err = io.Copy(bw, zfd)
+		_, err = io.Copy(bw, io.LimitReader(zfd, MaxReadLimit))
 
 		bw.Flush()
 		fd.Close()