gzip/inflate: harden GZIP header parsing and ISIZE validation

- gzs(): reject reserved FLG bits (0xE0); add bounds checks for
  FEXTRA length field before reading it to prevent out-of-bounds access
  on truncated headers
- gzl(): reject ISIZE values above Int range (>= 0x80000000); now raises
  FzipError instead of returning a negative Int
- gunzip_sync(): validate ISIZE against max_output_size before allocating
  the output buffer; verify that inflate wrote exactly isize bytes and
  raise InvalidZipData on mismatch; call trim_buf() to return a
  correctly sized slice when a caller-supplied oversized buffer is used
- inflate/inflt(): reject code-length repeat symbol 16 (copy previous)
  when it appears at index 0 (no previous value); reject repeat counts
  that would overflow the code-length table
- Update GunzipOptions doc comment to reflect that ISIZE is now checked
  against max_output_size and that max_output_size is a hard limit
- Add tests: ISIZE > max_output_size before allocation, ISIZE mismatch
  after inflate, oversized caller buffer trimmed correctly, FEXTRA
  truncated length, FEXTRA length exceeds input, reserved FLG bits
  rejected, code-length repeat 16 at index 0, repeat count overflow

Author: hustcer

src/gzip.mbt

@@ -36,9 +36,19 @@ fn gzs(d : FixedArray[Byte]) -> Int raise FzipError {
     raise fzip_err(InvalidHeader, msg="invalid gzip data")
   }
   let flg = d[3].to_int()
+  if (flg & 0xE0) != 0 {
+    raise fzip_err(InvalidHeader, msg="invalid gzip data")
+  }
   let mut st = 10
   if (flg & 4) != 0 {
-    st += (d[10].to_int() | (d[11].to_int() << 8)) + 2
+    if st > d.length() - 2 {
+      raise fzip_err(InvalidHeader, msg="invalid gzip data")
+    }
+    let extra_len = d[st].to_int() | (d[st + 1].to_int() << 8)
+    st += extra_len + 2
+    if st > d.length() {
+      raise fzip_err(InvalidHeader, msg="invalid gzip data")
+    }
   }
   // skip FNAME and FCOMMENT
   let mut zs = ((flg >> 3) & 1) + ((flg >> 4) & 1)
@@ -56,15 +66,13 @@ fn gzs(d : FixedArray[Byte]) -> Int raise FzipError {
 }
 
 ///|
-/// Read GZIP original (uncompressed) size from footer
-fn gzl(d : FixedArray[Byte]) -> Int {
-  let l = d.length()
-  (d[l - 4].to_int() |
-  (d[l - 3].to_int() << 8) |
-  (d[l - 2].to_int() << 16) |
-  (d[l - 1].to_int() << 24))
-  .reinterpret_as_uint()
-  .reinterpret_as_int()
+/// Read a sync-API-safe GZIP ISIZE footer value.
+fn gzl(d : FixedArray[Byte]) -> Int raise FzipError {
+  let raw = b4(d, d.length() - 4)
+  if raw > max_int_val().reinterpret_as_uint() {
+    raise fzip_err(InvalidZipData, msg="gzip ISIZE exceeds Int range")
+  }
+  raw.reinterpret_as_int()
 }
 
 ///|
@@ -116,16 +124,20 @@ pub fn gunzip_sync(
   if st + 8 > data.length() {
     raise fzip_err(InvalidHeader, msg="invalid gzip data")
   }
+  let isize = gzl(data)
+  if isize > opts.max_output_size {
+    raise fzip_err(InvalidZipData, msg="gzip ISIZE exceeds max_output_size")
+  }
   let out = match opts.out {
     Some(o) => o
-    None => FixedArray::make(gzl(data), b'\x00')
+    None => FixedArray::make(isize, b'\x00')
   }
   let crc_st : CRC32State? = if opts.verify_checksum {
     Some(CRC32State::new())
   } else {
     None
   }
-  let (buf, _len) = inflt(
+  let (buf, len) = inflt(
     data,
     InflateState::new(2),
     Some(out),
@@ -145,5 +157,8 @@ pub fn gunzip_sync(
     }
     None => ()
   }
-  buf
+  if len != isize {
+    raise fzip_err(InvalidZipData, msg="gzip ISIZE mismatch")
+  }
+  trim_buf(buf, len)
 }

src/gzip_wbtest.mbt

@@ -90,6 +90,61 @@ test "gunzip with verify_checksum=true detects corruption" {
   assert_true(result == Some(InvalidChecksum), msg="expected InvalidChecksum")
 }
 
+///|
+test "gunzip - rejects ISIZE above max_output_size before allocation" {
+  let data : FixedArray[Byte] = [b'H', b'i']
+  let compressed = gzip_sync(data)
+  w4(compressed, compressed.length() - 4, 1000U)
+  let result : Result[FixedArray[Byte], FzipError] = try? gunzip_sync(
+    compressed,
+    opts={
+      out: None,
+      dictionary: None,
+      max_output_size: 16,
+      max_input_size: default_max_input_size,
+      verify_checksum: true,
+    },
+  )
+  guard result is Err(FzipError(code~, message~)) else {
+    fail("expected error")
+  }
+  assert_eq(code, InvalidZipData)
+  assert_true(message.contains("ISIZE exceeds max_output_size"))
+}
+
+///|
+test "gunzip - rejects ISIZE mismatch after successful inflate" {
+  let data : FixedArray[Byte] = [b'H', b'e', b'l', b'l', b'o']
+  let compressed = gzip_sync(data)
+  w4(compressed, compressed.length() - 4, 8U)
+  let result : Result[FixedArray[Byte], FzipError] = try? gunzip_sync(
+    compressed,
+  )
+  guard result is Err(FzipError(code~, message~)) else {
+    fail("expected error")
+  }
+  assert_eq(code, InvalidZipData)
+  assert_true(message.contains("ISIZE mismatch"))
+}
+
+///|
+test "gunzip - trims oversized caller output buffer" {
+  let data : FixedArray[Byte] = [b'H', b'e', b'l', b'l', b'o']
+  let compressed = gzip_sync(data)
+  let out = FixedArray::make(32, b'\x00')
+  let result = gunzip_sync(compressed, opts={
+    out: Some(out),
+    dictionary: None,
+    max_output_size: default_max_output_size,
+    max_input_size: default_max_input_size,
+    verify_checksum: true,
+  })
+  assert_eq(result.length(), data.length())
+  for i in 0..<data.length() {
+    assert_eq(result[i], data[i])
+  }
+}
+
 ///|
 test "gzip level 9" {
   let data : FixedArray[Byte] = [1, 2, 3, 4, 5]

src/inflate.mbt

@@ -229,6 +229,9 @@ fn inflt(
             let mut c = 0
             let mut n = 0
             if s == 16 {
+              if i == 0 {
+                raise fzip_err(InvalidLengthLiteral)
+              }
               while bcnt < 2 && bpos < dat_end {
                 bbuf = bbuf | (dat[bpos].to_int() << bcnt)
                 bpos += 1
@@ -257,6 +260,9 @@ fn inflt(
               bbuf = bbuf >> 7
               bcnt -= 7
             }
+            if n > tl - i {
+              raise fzip_err(InvalidLengthLiteral)
+            }
             while n > 0 {
               ldt[i] = c.to_byte()
               i += 1

src/inflate_wbtest.mbt

@@ -371,6 +371,28 @@ test "inflate - truncated data error" {
   assert_true(result is Err(_))
 }
 
+///|
+test "inflate - rejects code length repeat 16 at start" {
+  let malformed : FixedArray[Byte] = [b'\x05', b'\x00', b'\x02', b'\x00']
+  let result : Result[FixedArray[Byte], FzipError] = try? inflate_sync(
+    malformed,
+  )
+  guard result is Err(FzipError(code~, ..)) else { fail("expected error") }
+  assert_eq(code, InvalidLengthLiteral)
+}
+
+///|
+test "inflate - rejects code length repeat overflow" {
+  let malformed : FixedArray[Byte] = [
+    b'\x05', b'\x00', b'\x80', b'\xC0', b'\xDF', b'\x1F',
+  ]
+  let result : Result[FixedArray[Byte], FzipError] = try? inflate_sync(
+    malformed,
+  )
+  guard result is Err(FzipError(code~, ..)) else { fail("expected error") }
+  assert_eq(code, InvalidLengthLiteral)
+}
+
 ///|
 test "inflate - custom max_output_size limit" {
   // Test that max_output_size is enforced

src/security_wbtest.mbt

@@ -32,6 +32,36 @@ test "security/gzip - FNAME flag but truncated" {
   assert_true(result is Err(_))
 }
 
+///|
+test "security/gzip - FEXTRA flag but truncated length" {
+  let truncated : FixedArray[Byte] = [
+    b'\x1F', b'\x8B', b'\x08', b'\x04', b'\x00', b'\x00', b'\x00', b'\x00', b'\x00',
+    b'\x03',
+  ]
+  let result = try? gunzip_sync(truncated)
+  assert_true(result is Err(_))
+}
+
+///|
+test "security/gzip - FEXTRA length exceeds input" {
+  let truncated : FixedArray[Byte] = [
+    b'\x1F', b'\x8B', b'\x08', b'\x04', b'\x00', b'\x00', b'\x00', b'\x00', b'\x00',
+    b'\x03', b'\x10', b'\x00',
+  ]
+  let result = try? gunzip_sync(truncated)
+  assert_true(result is Err(_))
+}
+
+///|
+test "security/gzip - reserved flags rejected" {
+  let invalid : FixedArray[Byte] = [
+    b'\x1F', b'\x8B', b'\x08', b'\xE0', b'\x00', b'\x00', b'\x00', b'\x00', b'\x00',
+    b'\x03', b'\x03', b'\x00', b'\x00', b'\x00', b'\x00', b'\x00', b'\x00', b'\x00',
+  ]
+  let result = try? gunzip_sync(invalid)
+  assert_true(result is Err(_))
+}
+
 ///|
 test "security/zlib - empty input" {
   let empty : FixedArray[Byte] = []

src/types.mbt

@@ -84,14 +84,14 @@ pub fn GzipOptions::default() -> GzipOptions {
 /// By default fzip verifies the CRC-32 footer to detect corrupted data. Disable
 /// `verify_checksum` only when data integrity is already guaranteed elsewhere
 /// and decompression speed is more important. When `out` is not supplied,
-/// `gunzip_sync` allocates its output from the GZIP ISIZE footer; callers that
-/// need a strict output cap should provide an appropriately sized `out` buffer.
+/// `gunzip_sync` allocates its output from the GZIP ISIZE footer after checking
+/// it against `max_output_size`.
 pub(all) struct GunzipOptions {
   /// Optional pre-allocated output buffer; when supplied, it must fit the full output.
   out : FixedArray[Byte]?
   /// Optional preset dictionary used by the inner DEFLATE stream.
   dictionary : FixedArray[Byte]?
-  /// Output size limit used only when the inner inflater grows its buffer.
+  /// Maximum allowed uncompressed output size.
   max_output_size : Int
   /// Maximum allowed compressed input size.
   max_input_size : Int