python · rhpvorderman · Oct 18, 2021 · Oct 18, 2021
diff --git a/Lib/gzip.py b/Lib/gzip.py
@@ -442,14 +442,14 @@ def _read_gzip_header(fp):
    if flag & FNAME:
        # Read and discard a null-terminated string containing the filename
        while True:
-            s = fp.read(1)
-            if not s or s==b'\000':
+            s = _read_exact(fp, 1)
+            if s == b'\000':
                break
    if flag & FCOMMENT:
        # Read and discard a null-terminated string containing a comment
        while True:
-            s = fp.read(1)
-            if not s or s==b'\000':
+            s = _read_exact(fp, 1)
+            if s == b'\000':
                break
    if flag & FHCRC:
        _read_exact(fp, 2)     # Read & discard the 16-bit header CRC
@@ -607,6 +607,9 @@ def decompress(data):
        do = zlib.decompressobj(wbits=-zlib.MAX_WBITS)
        # Read all the data except the header
        decompressed = do.decompress(data[fp.tell():])
+        if not do.eof or len(do.unused_data) < 8:
+            raise EOFError("Compressed file ended before the end-of-stream "
+                           "marker was reached")
        crc, length = struct.unpack("<II", do.unused_data[:8])
        if crc != zlib.crc32(decompressed):
            raise BadGzipFile("CRC check failed")

diff --git a/Lib/test/test_gzip.py b/Lib/test/test_gzip.py
@@ -562,6 +562,20 @@ def test_decompress(self):
            datac = gzip.compress(data)
            self.assertEqual(gzip.decompress(datac), data)

+    def test_truncated_header(self):
+        truncated_headers = [
+            b"\x1f\x8b\x08\x00\x00\x00\x00\x00\x00",             # Missing OS byte
+            b"\x1f\x8b\x08\x02\x00\x00\x00\x00\x00\xff",         # FHRC, but no checksum
+            b"\x1f\x8b\x08\x04\x00\x00\x00\x00\x00\xff",         # FEXTRA, but no xlen
+            b"\x1f\x8b\x08\x04\x00\x00\x00\x00\x00\xff\xaa\x00", # FEXTRA, xlen, but no data
+            b"\x1f\x8b\x08\x08\x00\x00\x00\x00\x00\xff",         # FNAME but no fname
+            b"\x1f\x8b\x08\x10\x00\x00\x00\x00\x00\xff",         # FCOMMENT, but no fcomment
+        ]
+        for header in truncated_headers:
+            with self.subTest(header=header):
+                self.assertRaises(EOFError, gzip._read_gzip_header,
+                                  io.BytesIO(header))
+
    def test_read_truncated(self):
        data = data1*50
        # Drop the CRC (4 bytes) and file size (4 bytes).

diff --git a/Misc/NEWS.d/next/Library/2021-10-18-11-20-24.bpo-45507.vWx2yS.rst b/Misc/NEWS.d/next/Library/2021-10-18-11-20-24.bpo-45507.vWx2yS.rst
@@ -0,0 +1,3 @@
+Make sure EOFerror is thrown when gzip headers have missing or truncated 
+NAME or COMMENT fields when FNAME or FCOMMENT flags are set.
+
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,3 @@
		Make sure EOFerror is thrown when gzip headers have missing or truncated
		NAME or COMMENT fields when FNAME or FCOMMENT flags are set.