Dashboard › institutional-transition-lab › ZipExtFile clips actual expansion

ZipExtFile clips actual expansion

Category: gotcha

Confidence: 1.00

ID: 01a0859c-3f32-7d4b-a199-7f1a33ccfd3f

Project ID: 1fa3712f-997f-4884-b7ec-8abb79f9e342

Cross-project: No

Recalled in other projects: 1

Source session: 0XzZzxSQLaAGJA7bv

Created: 2026-09-09 06:00:37

Updated: 2026-09-09 10:00:04

Cross-Project Recalls

Project	Hits	Last recalled
opencode-lore	2	1d ago

Content

Trap: declared ZipInfo.file_size totals and the length returned by ZipExtFile.read() look like expansion bounds, but BZIP2/LZMA may expand the full compressed chunk before ZipExtFile clips output to the forged declared size. Fix: enforce actual codec-output member and aggregate limits during decompression, require output length to equal the declaration, and test exact/+1 boundaries plus underproduction with small compressible fixtures.