Project

General

Profile

Actions
Copy link

Bug #4560

closed

Quadratic complexity in HTTP2 gzip decompression

Added by Philippe Antoine over 3 years ago. Updated almost 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
7.0.0-beta1
Affected Versions:
6.0.3
Effort:
Difficulty:
Label:
Needs backport to 6.0

Description

Found by oss-fuzz
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36132

The crate flate2, unlike C zlib library, keeps a buffer of the whole gzip header until it is complete.
And it parses it over and over again (computing the CRC) for each new added bytes.
This header can be indefinitely long thanks to FNAME flag
cf https://github.com/rust-lang/flate2-rs/blob/90d9e5ed866742ce8b3946d156830e300d1e5aab/src/gz/bufread.rs#L75

Related issues 1 (0 open — 1 closed)

Copied to Suricata - Bug #4640: Quadratic complexity in HTTP2 gzip decompressionClosedPhilippe AntoineActions
Actions
Copy link
 #1

Updated by Philippe Antoine over 3 years ago

  • Private changed from No to Yes
Actions
Copy link
 #2

Updated by Philippe Antoine over 3 years ago

  • Status changed from New to In Review
Actions
Copy link
 #3

Updated by Jeff Lucovsky about 3 years ago

  • Copied to Bug #4640: Quadratic complexity in HTTP2 gzip decompression added
Actions
Copy link
 #5

Updated by Philippe Antoine about 3 years ago

  • Status changed from In Review to Closed
Actions
Copy link
 #6

Updated by Victor Julien almost 3 years ago

  • Private changed from Yes to No
Actions
Copy link

Also available in: Atom PDF