Skip to content

CLI: Hang bomb with with crafted circular symbolic link causes "zstd -d -r -f" to infinitely loop. "pigz -d-r -f" skips symbolic links with non compressed suffix #4081

Open
@gcflymoto

Description

@gcflymoto

Describe the bug
When recursive decompression is used with -f to force, as the documentation states, it operates on links. However, the behavior of how it operates on links is different from other decompressors, including pigz

To Reproduce
Create a deeply nested cyclical soft link. (For security reasons I am not providing the reproduction to cause the bomb)

zstd -d -f -r --verbose crafted_hang_bomb_circular_soft_link
*** Zstandard CLI (64-bit) v1.5.6, by Yann Collet ***
(infinite hang)

While pigz exits with an appropriate error

pigz -d -f -r link
pigz: link does not have compressed suffix -- skipping

Expected behavior
Behave like pigz and skip soft links without the right suffix

Desktop (please complete the following information):

  • OS: SUSE
  • Version: SLES12SP5
  • Compiler: clang
  • Build system: Make

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions