Merge pull request #829 from onekey-sec/zlib-force-start-offset

fix(zlib): Limit zlib pattern at the start of the file
onekey-sec · Apr 11, 2024 · 1f72c09 · 1f72c09
2 parents 92072fd + d2a1bdd
commit 1f72c09
Show file tree

Hide file tree

Showing 5 changed files with 5 additions and 17 deletions.
diff --git a/tests/integration/compression/zlib/__input__/sample.prefix.zlib b/tests/integration/compression/zlib/__input__/sample.prefix.zlib
diff --git a/tests/integration/compression/zlib/__output__/sample.prefix.zlib_extract/0-5.unknown b/tests/integration/compression/zlib/__output__/sample.prefix.zlib_extract/0-5.unknown
diff --git a/tests/integration/compression/zlib/__output__/sample.prefix.zlib_extract/5-39.zlib b/tests/integration/compression/zlib/__output__/sample.prefix.zlib_extract/5-39.zlib
diff --git a/...ompression/zlib/__output__/sample.prefix.zlib_extract/5-39.zlib_extract/zlib.uncompressed b/...ompression/zlib/__output__/sample.prefix.zlib_extract/5-39.zlib_extract/zlib.uncompressed
diff --git a/unblob/handlers/compression/zlib.py b/unblob/handlers/compression/zlib.py
@@ -8,7 +8,7 @@
 from unblob.handlers.archive.dmg import DMGHandler
 
 from ...file_utils import DEFAULT_BUFSIZE, InvalidInputFormat
-from ...models import Extractor, File, Handler, HexString, ValidChunk
+from ...models import Extractor, File, Handler, Regex, ValidChunk
 
 logger = get_logger()
 
@@ -28,10 +28,10 @@ class ZlibHandler(Handler):
  NAME = "zlib"
 
  PATTERNS = [
- HexString("78 01"), # low compression
- HexString("78 9c"), # default compression
- HexString("78 da"), # best compression
- HexString("78 5e"), # compressed
+ Regex(r"^\x78\x01"), # low compression
+ Regex(r"^\x78\x9c"), # default compression
+ Regex(r"^\x78\xda"), # best compression
+ Regex(r"^\x78\x5e"), # compressed
  ]
 
  EXTRACTOR = ZlibExtractor()