Allocation of Resources Without Limits or Throttling Affecting github.com/ulikunitz/xz/lzma package, versions <0.5.14-rc.1

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the lzma.NewReader or lzma.ReaderConfig.NewReader functions when decoding a corrupted multiple LZMA archive. An attacker can cause excessive memory consumption by providing a specially crafted LZMA file with extraneous data at the beginning, leading to resource exhaustion and potential denial of service.

Note:

Only software that uses lzma.NewReader or lzma.ReaderConfig.NewReader is affected. There is no issue for software using the xz functionality.

const ProjectLocalPath = "some/path"
const TmpDir = "tmp"

func UnpackLZMA(lzmaFile string) error {
    file, err := os.Open(lzmaFile)
    if err != nil {
        return err
    }
    defer file.Close()

    reader, err := lzma.NewReader(bufio.NewReader(file))
    if err != nil {
        return err
    }

    tmpFile, err := os.CreateTemp(TmpDir, TmpLZMAPrefix)
    if err != nil {
        return err
    }
    defer func() {
        tmpFile.Close()
        _ = os.Remove(tmpFile.Name())
    }()

    sha256Hasher := sha256.New()
    multiWriter := io.MultiWriter(tmpFile, sha256Hasher)

    if _, err = io.Copy(multiWriter, reader); err != nil {
        return err
    }

    unpackHash := hex.EncodeToString(sha256Hasher.Sum(nil))
    unpackDir := filepath.Join(
        ProjectLocalPath, unpackHash[:2],
    )
    _ = os.MkdirAll(unpackDir, DirPerm)

    unpackPath := filepath.Join(unpackDir, unpackHash)

    return os.Rename(tmpFile.Name(), unpackPath)
}

• GitHub Commit