From 2349197bea8ebd1bf57a68f4a6549d8fd7585e66 Mon Sep 17 00:00:00 2001 From: Chenhao <24435007+tylzh97@users.noreply.github.com> Date: Wed, 22 Oct 2025 20:39:31 +0800 Subject: [PATCH] Fix: bug in `decode_definite_long_string()` that causes incorrect chunk length calculation (#265) Upstream: https://github.com/agronholm/cbor2/commit/2349197bea8ebd1bf57a68f4a6549d8fd7585e66 CVE: CVE-2025-64076 [thomas: stripped tests and changelog] Signed-off-by: Thomas Perale --- source/decoder.c | 8 +++++++- 1 files changed, 7 insertions(+), 1 deletion(-) diff --git a/source/decoder.c b/source/decoder.c index 043210b3..8b6b842c 100644 --- a/source/decoder.c +++ b/source/decoder.c @@ -758,7 +758,7 @@ decode_definite_long_string(CBORDecoderObject *self, Py_ssize_t length) char *buffer = NULL; while (left) { // Read up to 65536 bytes of data from the stream - Py_ssize_t chunk_length = 65536 - buffer_size; + Py_ssize_t chunk_length = 65536 - buffer_length; if (left < chunk_length) chunk_length = left; @@ -828,7 +828,13 @@ decode_definite_long_string(CBORDecoderObject *self, Py_ssize_t length) memcpy(buffer, bytes_buffer + consumed, unconsumed); } buffer_length = unconsumed; + } else { + // All bytes consumed, reset buffer_length + buffer_length = 0; } + + Py_DECREF(chunk); + chunk = NULL; } if (ret && string_namespace_add(self, ret, length) == -1)