Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

CLI: Hang bomb with with crafted circular symbolic link causes "zstd -d -r -f" to infinitely loop. "pigz -d-r -f" skips symbolic links with non compressed suffix #4081

Open
gcflymoto opened this issue Jun 26, 2024 · 0 comments
Labels

Comments

@gcflymoto
Copy link

gcflymoto commented Jun 26, 2024

Describe the bug
When recursive decompression is used with -f to force, as the documentation states, it operates on links. However, the behavior of how it operates on links is different from other decompressors, including pigz

To Reproduce
Create a deeply nested cyclical soft link. (For security reasons I am not providing the reproduction to cause the bomb)

zstd -d -f -r --verbose crafted_hang_bomb_circular_soft_link
*** Zstandard CLI (64-bit) v1.5.6, by Yann Collet ***
(infinite hang)

While pigz exits with an appropriate error

pigz -d -f -r link
pigz: link does not have compressed suffix -- skipping

Expected behavior
Behave like pigz and skip soft links without the right suffix

Desktop (please complete the following information):

  • OS: SUSE
  • Version: SLES12SP5
  • Compiler: clang
  • Build system: Make
@Cyan4973 Cyan4973 added the bug label Jun 27, 2024
@gcflymoto gcflymoto changed the title CLI: "zstd -d -r -f" will hang if it runs into a cyclical symbol link. "pigz -d-r -f" skips symbolic links with appropriate suffix CLI: Hang bomb with with crafted circular symbolic link causes "zstd -d -r -f" to infinitely loop. "pigz -d-r -f" skips symbolic links with non compressed suffix Jul 12, 2024
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants