[medium] Zip bomb: ZIP entries read fully into memory (ebook branch) #14

New issue

Closed

opened 2026-10-18 15:51:56 +00:00 by jfro · 0 comments

jfro commented

2026-10-18 15:51:56 +00:00

Owner

Severity: medium
Affects: jtk/ebook-management

File: lib/fuzzy_catalog/ebooks/zip_reader.ex:44-75 (zstream collects all chunks), :100-110 (:zip.extract :memory)
A crafted EPUB/CBZ in a library with a multi-GB container.xml/OPF/cover can OOM the BEAM during a scan.
Fix: check the uncompressed size in the entry header before reading; stop collecting past a cap (e.g. 5 MB for XML, 50 MB for images).

Found by Nye's audit, 2026-10-18 (static review of main @1d89af4 and jtk/ebook-management @43a849e).

**Severity:** medium **Affects:** jtk/ebook-management File: lib/fuzzy_catalog/ebooks/zip_reader.ex:44-75 (zstream collects all chunks), :100-110 (:zip.extract :memory) A crafted EPUB/CBZ in a library with a multi-GB container.xml/OPF/cover can OOM the BEAM during a scan. Fix: check the uncompressed size in the entry header before reading; stop collecting past a cap (e.g. 5 MB for XML, 50 MB for images). --- _Found by Nye's audit, 2026-10-18 (static review of main @1d89af4 and jtk/ebook-management @43a849e)._

jfro added the

ebook-branch

medium

security

labels

2026-10-18 15:51:56 +00:00

jfro referenced this issue

2026-10-18 15:53:32 +00:00

feat: ebook libraries, scanning, matching and downloads #17

jfro referenced this issue

2026-10-18 16:23:37 +00:00

Symlinks in an ebook library can expose any server file through downloads #27