[PATCH 1/2] erofs-utils: lib: add capacity ceiling in deflate partial decompression

[Utkal Singh]

In z_erofs_inflate_partial(), the dynamic buffer growth loop doubles
decodedcapacity on every LIBDEFLATE_INSUFFICIENT_SPACE return with no
upper bound. A crafted DEFLATE stream can trigger repeated realloc()
calls, leading to unbounded memory consumption and an OOM crash in
fsck.erofs or erofsfuse.

Introduce Z_EROFS_MAX_DECOMP_CAPACITY (64 MiB) and check the capacity
before each doubling. If the limit is reached, log an error and abort
with -EFSCORRUPTED via the existing out_inflate_end cleanup path.

This also prevents a theoretical integer overflow on the left-shift when
decodedcapacity approaches the size_t limit.

Signed-off-by: Utkal Singh <singhutkal015 at gmail.com>
---
 lib/decompress.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/decompress.c b/lib/decompress.c
index 3e7a173..f87efd5 100644
--- a/lib/decompress.c
+++ b/lib/decompress.c
@@ -240,6 +240,7 @@ int z_erofs_load_deflate_config(struct erofs_sb_info *sbi,
 #ifdef HAVE_LIBDEFLATE
 /* if libdeflate is available, use libdeflate instead. */
 #include <libdeflate.h>
+#define Z_EROFS_MAX_DECOMP_CAPACITY	(64U << 20)	/* 64 MiB ceiling */
 
 static int z_erofs_decompress_deflate(struct z_erofs_decompress_req *rq)
 {
@@ -281,6 +282,11 @@ static int z_erofs_decompress_deflate(struct z_erofs_decompress_req *rq)
 				ret = -EIO;
 				goto out_inflate_end;
 			}
+		if (decodedcapacity >= Z_EROFS_MAX_DECOMP_CAPACITY) {
+			erofs_err("deflate partial decompression capacity limit exceeded");
+			ret = -EFSCORRUPTED;
+			goto out_inflate_end;
+		}
 			decodedcapacity = decodedcapacity << 1;
 			dest = realloc(buff, decodedcapacity);
 			if (!dest) {
-- 
2.43.0