Project

General

Profile

Actions

Bug #4560

closed

Quadratic complexity in HTTP2 gzip decompression

Added by Philippe Antoine over 2 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Needs backport to 6.0

Description

Found by oss-fuzz
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36132

The crate flate2, unlike C zlib library, keeps a buffer of the whole gzip header until it is complete.
And it parses it over and over again (computing the CRC) for each new added bytes.
This header can be indefinitely long thanks to FNAME flag
cf https://github.com/rust-lang/flate2-rs/blob/90d9e5ed866742ce8b3946d156830e300d1e5aab/src/gz/bufread.rs#L75


Related issues 1 (0 open1 closed)

Copied to Suricata - Bug #4640: Quadratic complexity in HTTP2 gzip decompressionClosedPhilippe AntoineActions
Actions

Also available in: Atom PDF