From 5db1a3cd33339bb28e1354b58374bf1c18e15e6e Mon Sep 17 00:00:00 2001
From: mllken <emilliken@gmail.com>
Date: Wed, 12 Oct 2022 19:46:03 +0700
Subject: [PATCH 1/2] gzip: add bounds for safer header parsing

---
 lib/std/compress/gzip.zig | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/std/compress/gzip.zig b/lib/std/compress/gzip.zig
index 2377e182c2..8734aec767 100644
--- a/lib/std/compress/gzip.zig
+++ b/lib/std/compress/gzip.zig
@@ -15,6 +15,8 @@ const FEXTRA = 1 << 2;
 const FNAME = 1 << 3;
 const FCOMMENT = 1 << 4;
 
+const max_string_len = 1024;
+
 pub fn GzipStream(comptime ReaderType: type) type {
     return struct {
         const Self = @This();
@@ -71,7 +73,7 @@ pub fn GzipStream(comptime ReaderType: type) type {
                 filename = try source.readUntilDelimiterAlloc(
                     allocator,
                     0,
-                    std.math.maxInt(usize),
+                    max_string_len,
                 );
             }
             errdefer if (filename) |p| allocator.free(p);
@@ -81,7 +83,7 @@ pub fn GzipStream(comptime ReaderType: type) type {
                 comment = try source.readUntilDelimiterAlloc(
                     allocator,
                     0,
-                    std.math.maxInt(usize),
+                    max_string_len,
                 );
             }
             errdefer if (comment) |p| allocator.free(p);

From b25fc18aa657fbc5b0fbc332123fdd0121d8ca1c Mon Sep 17 00:00:00 2001
From: mllken <emilliken@gmail.com>
Date: Fri, 14 Oct 2022 13:07:25 +0700
Subject: [PATCH 2/2] gzip: add missing fields to header parsing

---
 lib/std/compress/gzip.zig | 44 +++++++++++++++++++--------------------
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/lib/std/compress/gzip.zig b/lib/std/compress/gzip.zig
index 8734aec767..735f30b176 100644
--- a/lib/std/compress/gzip.zig
+++ b/lib/std/compress/gzip.zig
@@ -33,9 +33,11 @@ pub fn GzipStream(comptime ReaderType: type) type {
         read_amt: usize,
 
         info: struct {
+            extra: ?[]const u8,
             filename: ?[]const u8,
             comment: ?[]const u8,
             modification_time: u32,
+            operating_system: u8,
         },
 
         fn init(allocator: mem.Allocator, source: ReaderType) !Self {
@@ -59,33 +61,27 @@ pub fn GzipStream(comptime ReaderType: type) type {
             // Operating system where the compression took place
             const OS = header[9];
             _ = XFL;
-            _ = OS;
 
-            if (FLG & FEXTRA != 0) {
-                // Skip the extra data, we could read and expose it to the user
-                // if somebody needs it.
+            const extra = if (FLG & FEXTRA != 0) blk: {
                 const len = try source.readIntLittle(u16);
-                try source.skipBytes(len, .{});
-            }
+                const tmp_buf = try allocator.alloc(u8, len);
+                errdefer allocator.free(tmp_buf);
 
-            var filename: ?[]const u8 = null;
-            if (FLG & FNAME != 0) {
-                filename = try source.readUntilDelimiterAlloc(
-                    allocator,
-                    0,
-                    max_string_len,
-                );
-            }
+                try source.readNoEof(tmp_buf);
+                break :blk tmp_buf;
+            } else null;
+            errdefer if (extra) |p| allocator.free(p);
+
+            const filename = if (FLG & FNAME != 0)
+                try source.readUntilDelimiterAlloc(allocator, 0, max_string_len)
+            else
+                null;
             errdefer if (filename) |p| allocator.free(p);
 
-            var comment: ?[]const u8 = null;
-            if (FLG & FCOMMENT != 0) {
-                comment = try source.readUntilDelimiterAlloc(
-                    allocator,
-                    0,
-                    max_string_len,
-                );
-            }
+            const comment = if (FLG & FCOMMENT != 0)
+                try source.readUntilDelimiterAlloc(allocator, 0, max_string_len)
+            else
+                null;
             errdefer if (comment) |p| allocator.free(p);
 
             if (FLG & FHCRC != 0) {
@@ -102,7 +98,9 @@ pub fn GzipStream(comptime ReaderType: type) type {
                 .info = .{
                     .filename = filename,
                     .comment = comment,
+                    .extra = extra,
                     .modification_time = MTIME,
+                    .operating_system = OS,
                 },
                 .read_amt = 0,
             };
@@ -110,6 +108,8 @@ pub fn GzipStream(comptime ReaderType: type) type {
 
         pub fn deinit(self: *Self) void {
             self.inflater.deinit();
+            if (self.info.extra) |extra|
+                self.allocator.free(extra);
             if (self.info.filename) |filename|
                 self.allocator.free(filename);
             if (self.info.comment) |comment|