QuickJS: fix infinite loop on inflate of a stream needing a dictionary

The qjs inflate loop treated only rc < 0 as an error.  Z_NEED_DICT is
positive, so a zlib stream with the FDICT flag and no dictionary made
inflate() return Z_NEED_DICT with no progress every iteration, spinning
forever and growing the output chain on attacker-controlled input.

Handle Z_NEED_DICT explicitly, matching the njs zlib module.

diff --git a/external/qjs_zlib_module.c b/external/qjs_zlib_module.c
index 5abf108a1ba5942df1a3d7a5cc9ee808783174c3..caeb2761efb7d1613bc10e1a59174846643e476b 100644 (file)
--- a/external/qjs_zlib_module.c
+++ b/external/qjs_zlib_module.c
@@ -415,6 +415,11 @@ qjs_zlib_ext_inflate(JSContext *ctx, JSValueConst this_val, int argc,
             goto fail;
         }
 
+        if (rc == Z_NEED_DICT) {
+            JS_ThrowTypeError(ctx, "failed to inflate, dictionary is required");
+            goto fail;
+        }
+
         njs_chb_written(&chain, chunk_size - stream.avail_out);
     }
 

diff --git a/test/zlib.t.mjs b/test/zlib.t.mjs
index faef1fb018a61e728f17af5514c81b2df4bd6553..612a41984ed29893132e1e0a53e76000ad9bc16d 100644 (file)
--- a/test/zlib.t.mjs
+++ b/test/zlib.t.mjs
@@ -93,6 +93,10 @@ let inflateSync_tsuite = {
 
         { value: zlib.deflateRawSync('WAKA', {dictionary: Buffer.from('WAKA')}),
           exception: 'InternalError: failed to inflate the compressed data: invalid distance too far back' },
+
+        { value: zlib.deflateSync('WAKA WAKA WAKA', {dictionary: Buffer.from('WAKA')}),
+          raw: false,
+          exception: 'TypeError: failed to inflate, dictionary is required' },
 ]};
 
 run([