DoS Issues #3529

Activity

1. ESultanik

   added this to the v0.6.0 milestone on Sep 11, 2026
2. ESultanik

   added the

   Bug

   issue type on Sep 11, 2026
3. ESultanik

   self-assigned this

   on Sep 11, 2026
4. ESultanik

   added sub-issues on Sep 11, 2026

   • PolyFile's own HTTP 1.1 pattern backtracks superlinearly on a run of carriage returns #3527
   • Gentoo Manifest regex takes superlinear time on runs of whitespace #3473
5. ESultanik

   marked this as blocking 5 issues on Sep 11, 2026

   • Fix matcher structure defects #3530
   • Three generated Kaitai parsers fail to import due to reserved keywords and an unescaped docstring #3462
   • A !:strength factor followed by a comment is silently discarded #3476
   • Concatenated ZIP archives: only the last is mapped, because EndOfCentralDirectory.load uses rfind #3466
   • Matcher.match() returns almost no structure when given an open stream instead of a path #3463
6. ESultanik

   unmarked this as blocking on Sep 11, 2026

   • A !:strength factor followed by a comment is silently discarded #3476
7. ESultanik

   marked this as blocking on Sep 11, 2026

   • Cut the v0.6.0 release #3533
8. ESultanik

   unmarked this as blocking 4 issues on Sep 11, 2026

   • Three generated Kaitai parsers fail to import due to reserved keywords and an unescaped docstring #3462
   • Fix matcher structure defects #3530
   • Concatenated ZIP archives: only the last is mapped, because EndOfCentralDirectory.load uses rfind #3466
   • Matcher.match() returns almost no structure when given an open stream instead of a path #3463
9. ESultanik commented on Sep 11, 2026

   

   ESultanik

   on Sep 11, 2026

   CollaboratorAuthor

   More actions

   A timing helper already exists — reuse it

   Both sub-issues call for "a shared helper that asserts a classification completes within a bound."
   One is already in the tree. Verified against master at 906d916.

   tests/test_magic.py:

   • MATCH_TIMEOUT_SECONDS: int = 60 at :556
   • MATCH_SCRIPT at :558-565, a standalone script that loads MagicMatcher.DEFAULT_INSTANCE,
     matches a file, and forces set(match.mimetypes)
   • MagicMatchingRegressionTest.match_in_subprocess at :627-649 — writes the input to a temp
     file, runs MATCH_SCRIPT in a subprocess, fails on subprocess.TimeoutExpired at :645, and
     returns elapsed wall-clock seconds
   • its only current caller, test_cpp_class_test_terminates at :651-654, added for Example files that cause an unexpected delay iterating (infinite?) matches  #3411

   It is not yet a real bound. It only fails when the process exceeds 60 seconds, and it discards
   the float it returns — :654 prints the elapsed time and asserts nothing. Neither #3527 nor #3473
   would be caught by a 60-second ceiling at the input sizes in their reproducers.

   So the shared change this issue exists for is: tighten match_in_subprocess into an actual
   assertion, then add one test per sub-issue on top of it. Do not write a second helper.

   Fix sites

   Sub-issue	Site
   #3527	polyfile/http/matcher.py:16 — the pattern inside the ExactNamedTempfile literal spanning :16-21. Nothing else in the milestone touches this file.
   #3473	polyfile/magic_defs/gentoo:38 — the gentoo-manifest named test. Its ten use invocations are at :10, 12, 14, 16, 18 and :24, 26, 28, 30, 32.

   One thing to carry into the pull request

   polyfile/magic_defs/gentoo is inherited from upstream libmagic (header
   $File: gentoo,v 1.6 2024/02/11). Patching it makes it the second local patch after c-lang,
   and a plain cp file/magic/Magdir/* polyfile/magic_defs/ would silently revert it.

   #3479 is building exactly the drift check that makes such patches discoverable, and it is running in
   the same wave. Whichever of the two merges second must add the gentoo entry to the other's
   allowlist. Note it in the PR body, and add the patch to docs/updating_libmagic_defs.md.
10. ESultanik

    closed this as completedin #3546on Sep 11, 2026