You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
CLI: Hang bomb with with crafted circular symbolic link causes "zstd -d -r -f" to infinitely loop. "pigz -d-r -f" skips symbolic links with non compressed suffix
#4081
Open
gcflymoto opened this issue
Jun 26, 2024
· 0 comments
Describe the bug
When recursive decompression is used with -f to force, as the documentation states, it operates on links. However, the behavior of how it operates on links is different from other decompressors, including pigz
To Reproduce
Create a deeply nested cyclical soft link. (For security reasons I am not providing the reproduction to cause the bomb)
gcflymoto
changed the title
CLI: "zstd -d -r -f" will hang if it runs into a cyclical symbol link. "pigz -d-r -f" skips symbolic links with appropriate suffix
CLI: Hang bomb with with crafted circular symbolic link causes "zstd -d -r -f" to infinitely loop. "pigz -d-r -f" skips symbolic links with non compressed suffix
Jul 12, 2024
Describe the bug
When recursive decompression is used with -f to force, as the documentation states, it operates on links. However, the behavior of how it operates on links is different from other decompressors, including pigz
To Reproduce
Create a deeply nested cyclical soft link. (For security reasons I am not providing the reproduction to cause the bomb)
zstd -d -f -r --verbose crafted_hang_bomb_circular_soft_link
*** Zstandard CLI (64-bit) v1.5.6, by Yann Collet ***
(infinite hang)
While pigz exits with an appropriate error
pigz -d -f -r link
pigz: link does not have compressed suffix -- skipping
Expected behavior
Behave like pigz and skip soft links without the right suffix
Desktop (please complete the following information):
The text was updated successfully, but these errors were encountered: