Actions
Bug #4640
closedQuadratic complexity in HTTP2 gzip decompression
Affected Versions:
Effort:
Difficulty:
Label:
Description
Found by oss-fuzz
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36132
The crate flate2, unlike C zlib library, keeps a buffer of the whole gzip header until it is complete.
And it parses it over and over again (computing the CRC) for each new added bytes.
This header can be indefinitely long thanks to FNAME flag
cf https://github.com/rust-lang/flate2-rs/blob/90d9e5ed866742ce8b3946d156830e300d1e5aab/src/gz/bufread.rs#L75
Updated by Jeff Lucovsky over 3 years ago
- Copied from Bug #4560: Quadratic complexity in HTTP2 gzip decompression added
Updated by Shivani Bhardwaj over 3 years ago
- Status changed from Assigned to Closed
- Assignee changed from Shivani Bhardwaj to Philippe Antoine
Fixed in the crate itself.
Actions