Reject oversized NUP members before writing them #1596

Merged

bronze-ff merged 1 commit from fix/nup-guard-decompressed-size into main

2026-11-10 11:25:23 +00:00

bronze-ff commented

2026-11-10 10:20:08 +00:00

(Migrated from github.com)

The NUP extractor checks the size of a compressed member after it has written the decoded bytes. A malformed member can therefore write more than its declared size before extraction rejects it.

Check the cumulative decoded size before passing each chunk to the output. This retains the existing checks for incomplete frames, trailing bytes, and short output.

The regression builds a game-free NUP with a member that declares 8 bytes and expands to 65,536. Before the patch, the actual reader rejected the package after writing all 65,536 bytes. It now rejects the first chunk before writing any of it. The extraction CLI also rejected the fixture and left neither the output nor its temporary member.

Five targeted Windows suites and three Linux suites passed locally. The patch also merges cleanly with the two open long-path PRs (#1497 and #1516).

The NUP extractor checks the size of a compressed member after it has written the decoded bytes. A malformed member can therefore write more than its declared size before extraction rejects it. Check the cumulative decoded size before passing each chunk to the output. This retains the existing checks for incomplete frames, trailing bytes, and short output. The regression builds a game-free NUP with a member that declares 8 bytes and expands to 65,536. Before the patch, the actual reader rejected the package after writing all 65,536 bytes. It now rejects the first chunk before writing any of it. The extraction CLI also rejected the fixture and left neither the output nor its temporary member. Five targeted Windows suites and three Linux suites passed locally. The patch also merges cleanly with the two open long-path PRs (#1497 and #1516).