T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/iwa.py:82- Finding
Unbounded Archive and Snappy Decompression Enables Denial of Service
- Content
View full analysis
bytes: """Decompress a *raw* Snappy stream (uncompressed-length varint prefix).""" if not raw: return b"" pos = 0 length, pos = read_varint(raw, pos) out = bytearray() n = len(raw) while pos < n: tag = raw[pos] pos += 1 typ = tag & 0x03 if typ == 0: # literal lenfield = tag >> 2 if lenfield < 60: l = lenfield + 1 else: num = lenfield - 59 # 1..4 bytes for the length l = 0 for i in range(num): l |= raw[pos] << (8 * i) pos += 1 l += 1 out += raw[pos:pos + l] pos += l else: # copy (back-reference) if typ == 1: # 1-byte offset cplen = ((tag >> 2) & 0x07) + 4 offset = ((tag >> 5) << 8) | raw[pos] pos += 1 elif typ == 2: # 2-byte offset cplen = (tag >> 2) + 1 offset = raw[pos] | (raw[pos + 1] << 8) pos += 2 else: # typ == 3: 4-byte offset cplen = (tag >> 2) + 1 offset = (raw[pos] | (raw[pos + 1] << 8) | (raw[pos + 2] << 16) | (raw[pos + 3] << 24)) pos += 4 if offset == 0 or offset > len(out): raise ValueError("invalid Snappy copy offset") start = len(out) - offset for i in range(cplen): out.append(out[start + i]) if len(out) != length: ...[truncated 4697 chars]- Remediation
View remediation
MAX_SNAPPY_OUTPUT: raise ValueError("Snappy output exceeds configured limit") ``` The implementation must additionally check growth before every append because the declared length itself is attacker-controlled and malform ...[truncated 53 chars]