jfro/fuzzy_catalog
Watch
1
0
Fork
You've already forked fuzzy_catalog
 0
Code Issues 14 Pull requests Projects Releases 2 Packages 1 Wiki Activity Actions

[low] ZIP reader: CPU on skipped entries, no timeout on :zip extraction #44

New issue
Open
opened 2026-10-18 17:46:55 +00:00 by jfro · 0 comments
jfro commented 2026-10-18 17:46:55 +00:00
Owner
Copy link

Found by Nye reviewing PR #41 (#14, zip bomb caps). Non-blocking, low.

  1. Zstream inflates every entry it passes while searching for the target, so a huge entry before the target costs unbounded CPU (memory stays bounded). Could also cap total inflated bytes across skipped entries.
  2. extract_capped's receive has no after timeout, so a stuck :zip extraction blocks the Oban worker forever. Add e.g. a 60s timeout that kills the pid.
Found by Nye reviewing PR #41 (#14, zip bomb caps). Non-blocking, low. 1. Zstream inflates every entry it passes while searching for the target, so a huge entry before the target costs unbounded CPU (memory stays bounded). Could also cap total inflated bytes across skipped entries. 2. `extract_capped`'s `receive` has no `after` timeout, so a stuck `:zip` extraction blocks the Oban worker forever. Add e.g. a 60s timeout that kills the pid.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
jtk/git-cliff-release
v0.6.1
v0.6.0
v0.5.1
v0.5.0
v0.4.0
v0.3.1
v0.3.0
v0.2.0
v0.1.0
Labels
Clear labels   
bug

   
critical

   
ebook-branch

   
high

   
low

   
main

   
medium

   
release-blocker

   
security
No labels
bug
critical
ebook-branch
high
low
main
medium
release-blocker
security
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfro/fuzzy_catalog#44
No description provided.