Deflate decompression hangs on trailing garbage

[vojtarylko]

I tried to extend HTTPRequestDecompressorTest with this test case:

    func testDecompressionTrailingData() throws {
        // Valid compressed data with some trailing garbage
        let compressed = ByteBuffer(bytes: [120, 156, 99, 0, 0, 0, 1, 0, 1] + [1, 2, 3])

        let channel = EmbeddedChannel()
        try channel.pipeline.addHandler(NIOHTTPRequestDecompressor(limit: .none)).wait()
        let headers = HTTPHeaders([("Content-Encoding", "deflate"), ("Content-Length", "\(compressed.readableBytes)")])
        try channel.writeInbound(HTTPServerRequestPart.head(.init(version: .init(major: 1, minor: 1), method: .POST, uri: "https://nio.swift.org/test", headers: headers)))

        try channel.writeInbound(HTTPServerRequestPart.body(compressed))
    }

and when tried to run it, the test hangs forever.

If confirmed, this is security issue which can cause DoS.

[Lukasa]

Great catch, resolved by #177. I'll try to get a fix out ASAP. I'll also retroactively apply for a CVE and publish a notification, but as this was publicly reported I'd like to get the release out first. Thanks so much for reporting!

[Lukasa]

Fix is out.

[vojtarylko]

@Lukasa Thanks for fast fix! Was CVE published already?

[Lukasa]

Not yet, I’ll update this issue when it is.

[Lukasa]

We've assigned this CVE-2022-3252.