Bug #13616: Zlib::GzipReader#pos underflows after calling #ungetbyte or #ungetc at start of file

• Status: Closed
• Assignee: -
• Target version: -
• ruby -v: ruby 2.4.1p111 (2017-03-22 revision 58053) [x86_64-darwin16]
• Backport: 2.2: REQUIRED, 2.3: DONE, 2.4: DONE

[haines (Andrew Haines)]

After calling #ungetbyte or #ungetc at the start of file, Zlib::GzipReader#pos should be negative. However, the calculation uses unsigned integers, and underflow occurs.

Instead of the expected -1, the below outputs 18446744073709551615 on my machine:

require 'zlib'

gz = Zlib::GzipReader.new(StringIO.new([
  31, 139, 8, 0, 44, 220, 209, 71, 0, 3, 51, 52, 50, 54, 49, 77,
  76, 74, 78, 73, 5, 0, 157, 5, 0, 36, 10, 0, 0, 0
].pack("C*")))

gz.ungetbyte 0x21

p gz.pos

#read still returns the correct string ("!12345abcde" in this case).

[haines (Andrew Haines)]

• File 0001-Fix-underflow-of-Zlib-GzipReader-pos.patch 0001-Fix-underflow-of-Zlib-GzipReader-pos.patch added

Here's an attempt at a patch to check if pos will be negative and handle that scenario accordingly.

[naruse (Yui NARUSE)]

• Status changed from Open to Closed

Applied in changeset trunk|r59333.

---

Zlib::GzipReader#pos underflows after calling #ungetbyte or #ungetc at start of file [Bug #13616]

patched by Andrew Haines [e-mail] [ruby-core:81488]

[naruse (Yui NARUSE)]

• Backport changed from 2.2: UNKNOWN, 2.3: UNKNOWN, 2.4: UNKNOWN to 2.2: REQUIRED, 2.3: REQUIRED, 2.4: REQUIRED

[usa (Usaku NAKAMURA)]

• Backport changed from 2.2: REQUIRED, 2.3: REQUIRED, 2.4: REQUIRED to 2.2: REQUIRED, 2.3: DONE, 2.4: REQUIRED

ruby_2_3 r59532 merged revision(s) 59333,59337.

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 2.2: REQUIRED, 2.3: DONE, 2.4: REQUIRED to 2.2: REQUIRED, 2.3: DONE, 2.4: DONE

ruby_2_4 r59807 merged revision(s) 58524,58525,58526,59333,59337.