Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CLI: Hang bomb with with crafted circular symbolic link causes "zstd -d -r -f" to infinitely loop. "pigz -d-r -f" skips symbolic links with non compressed suffix #4081

Open
gcflymoto opened this issue Jun 26, 2024 · 0 comments
Labels

Comments

@gcflymoto
Copy link

gcflymoto commented Jun 26, 2024

Describe the bug
When recursive decompression is used with -f to force, as the documentation states, it operates on links. However, the behavior of how it operates on links is different from other decompressors, including pigz

To Reproduce
Create a deeply nested cyclical soft link. (For security reasons I am not providing the reproduction to cause the bomb)

zstd -d -f -r --verbose crafted_hang_bomb_circular_soft_link
*** Zstandard CLI (64-bit) v1.5.6, by Yann Collet ***
(infinite hang)

While pigz exits with an appropriate error

pigz -d -f -r link
pigz: link does not have compressed suffix -- skipping

Expected behavior
Behave like pigz and skip soft links without the right suffix

Desktop (please complete the following information):

  • OS: SUSE
  • Version: SLES12SP5
  • Compiler: clang
  • Build system: Make
@Cyan4973 Cyan4973 added the bug label Jun 27, 2024
@gcflymoto gcflymoto changed the title CLI: "zstd -d -r -f" will hang if it runs into a cyclical symbol link. "pigz -d-r -f" skips symbolic links with appropriate suffix CLI: Hang bomb with with crafted circular symbolic link causes "zstd -d -r -f" to infinitely loop. "pigz -d-r -f" skips symbolic links with non compressed suffix Jul 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants