bpo-45507: Throw EOF error when gzip headers or trailers are truncated

Lib/gzip.py

@@ -442,14 +442,14 @@ def _read_gzip_header(fp):
     if flag & FNAME:
         # Read and discard a null-terminated string containing the filename
         while True:
-            s = fp.read(1)
-            if not s or s==b'\000':
+            s = _read_exact(fp, 1)
+            if s == b'\000':
                 break
     if flag & FCOMMENT:
         # Read and discard a null-terminated string containing a comment
         while True:
-            s = fp.read(1)
-            if not s or s==b'\000':
+            s = _read_exact(fp, 1)
+            if s == b'\000':
                 break
     if flag & FHCRC:
         _read_exact(fp, 2)     # Read & discard the 16-bit header CRC
@@ -607,6 +607,9 @@ def decompress(data):
         do = zlib.decompressobj(wbits=-zlib.MAX_WBITS)
         # Read all the data except the header
         decompressed = do.decompress(data[fp.tell():])
+        if not do.eof or len(do.unused_data) < 8:
+            raise EOFError("Compressed file ended before the end-of-stream "
+                           "marker was reached")
         crc, length = struct.unpack("<II", do.unused_data[:8])
         if crc != zlib.crc32(decompressed):
             raise BadGzipFile("CRC check failed")

Lib/test/test_gzip.py

@@ -562,6 +562,20 @@ def test_decompress(self):
             datac = gzip.compress(data)
             self.assertEqual(gzip.decompress(datac), data)
 
+    def test_truncated_header(self):
+        truncated_headers = [
+            b"\x1f\x8b\x08\x00\x00\x00\x00\x00\x00",             # Missing OS byte
+            b"\x1f\x8b\x08\x02\x00\x00\x00\x00\x00\xff",         # FHRC, but no checksum
+            b"\x1f\x8b\x08\x04\x00\x00\x00\x00\x00\xff",         # FEXTRA, but no xlen
+            b"\x1f\x8b\x08\x04\x00\x00\x00\x00\x00\xff\xaa\x00", # FEXTRA, xlen, but no data
+            b"\x1f\x8b\x08\x08\x00\x00\x00\x00\x00\xff",         # FNAME but no fname
+            b"\x1f\x8b\x08\x10\x00\x00\x00\x00\x00\xff",         # FCOMMENT, but no fcomment
+        ]
+        for header in truncated_headers:
+            with self.subTest(header=header):
+                self.assertRaises(EOFError, gzip._read_gzip_header,
+                                  io.BytesIO(header))
+
     def test_read_truncated(self):
         data = data1*50
         # Drop the CRC (4 bytes) and file size (4 bytes).

Misc/NEWS.d/next/Library/2021-10-18-11-20-24.bpo-45507.vWx2yS.rst

@@ -0,0 +1,3 @@
+Make sure EOFerror is thrown when gzip headers have missing or truncated 
+NAME or COMMENT fields when FNAME or FCOMMENT flags are set.
+