exlim/cyberchef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

XPRESS: fix empty-output EOD underflow, raise output cap to 32 MiB

Browse Source 
The mid-stream end-of-data-as-match(3,1) fallback indexed out[-1] when
the output was still empty, pushing undefined into the result; guard it
the same way the Go and C ports now do. Also raise MAX_DECOMPRESSED
from 1 MiB to 32 MiB (WIM chunks can be up to 32 MiB; WOF is 1 MiB)
and update the author tags to the real email. Found by the FuzzXpress
target added to klauspost/compress.
This commit is contained in:
MP GOWTHAM 2026-08-14 18:54:45 +05:30
parent 699bd73c0d
commit 98ec000e62
4 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/core/lib/XPRESS.mjs
View File

@ -1,7 +1,7 @@
/**
* XPRESS (MS-XCA) decompression.
*
* @author MP Gowtham [mpgowtham@users.noreply.github.com]
* @author MP Gowtham [gowthamrockerzzz@gmail.com]
* @copyright Crown Copyright 2026
* @license Apache-2.0
*
@ -15,8 +15,9 @@
import OperationError from "../errors/OperationError.mjs";
/** Maximum output per call (Windows limits XPRESS blocks to 1 MiB). */
const MAX_DECOMPRESSED = 1000000;
/** Maximum output per call (Windows sizes XPRESS blocks at up to
* 32 MiB for WIM chunks and up to 1 MiB for WOF chunks). */
const MAX_DECOMPRESSED = 32 * 1024 * 1024;
/**
* Decompress an XPRESS plain-LZ77 stream.
@ -200,7 +201,7 @@ export function decompressHuffman(input, decompressedSize) {
// End of data; mid-stream it decodes as a match(3, 1).
if (out.length === decompressedSize)
break;
if (decompressedSize - out.length < 3)
if (out.length === 0 || decompressedSize - out.length < 3)
throw new OperationError("XPRESS: corrupt end-of-data marker");
const start = out.length - 1;
for (let j = 0; j < 3; j++)

2
src/core/operations/XPRESSDecompress.mjs
View File

@ -1,5 +1,5 @@
/**
* @author MP Gowtham [mpgowtham@users.noreply.github.com]
* @author MP Gowtham [gowthamrockerzzz@gmail.com]
* @copyright Crown Copyright 2026
* @license Apache-2.0
*/

2
src/core/operations/XPRESSHuffmanDecompress.mjs
View File

@ -1,5 +1,5 @@
/**
* @author MP Gowtham [mpgowtham@users.noreply.github.com]
* @author MP Gowtham [gowthamrockerzzz@gmail.com]
* @copyright Crown Copyright 2026
* @license Apache-2.0
*/

2
tests/operations/tests/XPRESS.mjs
View File

@ -1,7 +1,7 @@
/**
* XPRESS tests.
*
* @author MP Gowtham [mpgowtham@users.noreply.github.com]
* @author MP Gowtham [gowthamrockerzzz@gmail.com]
* @copyright Crown Copyright 2026
* @license Apache-2.0
*/