[Git][java-team/netty][CVE-2025-58057] CVE-2025-58057
Bastien Roucariès (@rouca)
gitlab at salsa.debian.org
Sun Nov 16 09:10:05 GMT 2025
Bastien Roucariès pushed to branch CVE-2025-58057 at Debian Java Maintainers / netty
Commits:
8c1e2f3c by Bastien Roucariès at 2025-11-16T10:09:26+01:00
CVE-2025-58057
- - - - -
3 changed files:
- debian/changelog
- + debian/patches/CVE-2025-58057.patch
- debian/patches/series
Changes:
=====================================
debian/changelog
=====================================
@@ -1,3 +1,18 @@
+netty (1:4.1.48-12) unstable; urgency=high
+
+ * Team upload
+ * Fix CVE-2025-58057:
+ When supplied with specially crafted input, BrotliDecoder
+ and certain other decompression decoders will allocate
+ a large number of reachable byte buffers, which can lead
+ to denial of service. BrotliDecoder.decompress has no limit
+ in how often it calls pull, decompressing data 64K bytes at
+ a time. The buffers are saved in the output list, and remain
+ reachable until OOM is hit.
+ (Closes: #1113994)
+
+ -- Bastien Roucariès <rouca at debian.org> Sun, 16 Nov 2025 09:30:49 +0100
+
netty (1:4.1.48-11) unstable; urgency=high
* Team upload
@@ -7,14 +22,6 @@ netty (1:4.1.48-11) unstable; urgency=high
that uses malformed HTTP/2 control frames in order to break
the max concurrent streams limit, which results in resource
exhaustion and distributed denial of service.
- * Fix CVE-2025-58056 (Closes: #1113994)
- when supplied with specially crafted input, BrotliDecoder and
- certain other decompression decoders will allocate a large
- number of reachable byte buffers, which can lead to
- denial of service. BrotliDecoder.decompress has
- no limit in how often it calls pull, decompressing
- data 64K bytes at a time. The buffers are saved in
- the output list, and remain reachable until OOM is hit.
* Fix CVE-2025-59419 (Closes: #1118282)
SMTP Command Injection Vulnerability Allowing Email Forgery
An SMTP Command Injection (CRLF Injection) vulnerability
=====================================
debian/patches/CVE-2025-58057.patch
=====================================
@@ -0,0 +1,926 @@
+From: Norman Maurer <norman_maurer at apple.com>
+Date: Wed, 3 Sep 2025 10:35:05 +0200
+Subject: [PATCH] Merge commit from fork (#15612)
+
+Motivation:
+
+We should ensure our decompressing decoders will fire their buffers
+through the pipeliner as fast as possible and so allow the user to take
+ownership of these as fast as possible. This is needed to reduce the
+risk of OOME as otherwise a small input might produce a large amount of
+data that can't be processed until all the data was decompressed in a
+loop. Beside this we also should ensure that other handlers that uses
+these decompressors will not buffer all of the produced data before
+processing it, which was true for HTTP and HTTP2.
+
+Modifications:
+
+- Adjust affected decoders (Brotli, Zstd and ZLib) to fire buffers
+through the pipeline as soon as possible
+- Adjust HTTP / HTTP2 decompressors to do the same
+- Add testcase.
+
+Result:
+
+Less risk of OOME when doing decompressing
+
+Co-authored-by: yawkat <jonas.konrad at oracle.com>
+
+origin: backport, https://github.com/netty/netty/commit/34894ac73b02efefeacd9c0972780b32dc3de04f
+---
+ .../handler/codec/http/HttpContentDecoder.java | 239 +++++++++++----------
+ .../codec/http/HttpContentDecompressorTest.java | 88 ++++++++
+ .../http2/DelegatingDecompressorFrameListener.java | 177 +++++++--------
+ .../handler/codec/compression/JZlibDecoder.java | 32 ++-
+ .../handler/codec/compression/JdkZlibDecoder.java | 45 ++--
+ .../codec/compression/AbstractIntegrationTest.java | 62 ++++++
+ 6 files changed, 416 insertions(+), 227 deletions(-)
+
+diff --git a/codec-http/src/main/java/io/netty/handler/codec/http/HttpContentDecoder.java b/codec-http/src/main/java/io/netty/handler/codec/http/HttpContentDecoder.java
+index d2513e4..3c43900 100644
+--- a/codec-http/src/main/java/io/netty/handler/codec/http/HttpContentDecoder.java
++++ b/codec-http/src/main/java/io/netty/handler/codec/http/HttpContentDecoder.java
+@@ -17,6 +17,7 @@ package io.netty.handler.codec.http;
+
+ import io.netty.buffer.ByteBuf;
+ import io.netty.channel.ChannelHandlerContext;
++import io.netty.channel.ChannelInboundHandlerAdapter;
+ import io.netty.channel.embedded.EmbeddedChannel;
+ import io.netty.handler.codec.CodecException;
+ import io.netty.handler.codec.DecoderResult;
+@@ -52,125 +53,136 @@ public abstract class HttpContentDecoder extends MessageToMessageDecoder<HttpObj
+ private EmbeddedChannel decoder;
+ private boolean continueResponse;
+ private boolean needRead = true;
++ private ByteBufForwarder forwarder;
+
+ @Override
+ protected void decode(ChannelHandlerContext ctx, HttpObject msg, List<Object> out) throws Exception {
+- try {
+- if (msg instanceof HttpResponse && ((HttpResponse) msg).status().code() == 100) {
++ needRead = true;
++ if (msg instanceof HttpResponse && ((HttpResponse) msg).status().code() == 100) {
+
+- if (!(msg instanceof LastHttpContent)) {
+- continueResponse = true;
+- }
+- // 100-continue response must be passed through.
+- out.add(ReferenceCountUtil.retain(msg));
+- return;
++ if (!(msg instanceof LastHttpContent)) {
++ continueResponse = true;
+ }
++ // 100-continue response must be passed through.
++ needRead = false;
++ ctx.fireChannelRead(ReferenceCountUtil.retain(msg));
++ return;
++ }
+
+- if (continueResponse) {
+- if (msg instanceof LastHttpContent) {
+- continueResponse = false;
+- }
+- // 100-continue response must be passed through.
+- out.add(ReferenceCountUtil.retain(msg));
+- return;
++ if (continueResponse) {
++ if (msg instanceof LastHttpContent) {
++ continueResponse = false;
+ }
++ needRead = false;
++ ctx.fireChannelRead(ReferenceCountUtil.retain(msg));
++ return;
++ }
+
+- if (msg instanceof HttpMessage) {
+- cleanup();
+- final HttpMessage message = (HttpMessage) msg;
+- final HttpHeaders headers = message.headers();
++ if (msg instanceof HttpMessage) {
++ cleanup();
++ final HttpMessage message = (HttpMessage) msg;
++ final HttpHeaders headers = message.headers();
+
+- // Determine the content encoding.
+- String contentEncoding = headers.get(HttpHeaderNames.CONTENT_ENCODING);
+- if (contentEncoding != null) {
+- contentEncoding = contentEncoding.trim();
++ // Determine the content encoding.
++ String contentEncoding = headers.get(HttpHeaderNames.CONTENT_ENCODING);
++ if (contentEncoding != null) {
++ contentEncoding = contentEncoding.trim();
++ } else {
++ String transferEncoding = headers.get(HttpHeaderNames.TRANSFER_ENCODING);
++ if (transferEncoding != null) {
++ int idx = transferEncoding.indexOf(",");
++ if (idx != -1) {
++ contentEncoding = transferEncoding.substring(0, idx).trim();
++ } else {
++ contentEncoding = transferEncoding.trim();
++ }
+ } else {
+ contentEncoding = IDENTITY;
+ }
+- decoder = newContentDecoder(contentEncoding);
+-
+- if (decoder == null) {
+- if (message instanceof HttpContent) {
+- ((HttpContent) message).retain();
+- }
+- out.add(message);
+- return;
+- }
++ }
++ decoder = newContentDecoder(contentEncoding);
+
+- // Remove content-length header:
+- // the correct value can be set only after all chunks are processed/decoded.
+- // If buffering is not an issue, add HttpObjectAggregator down the chain, it will set the header.
+- // Otherwise, rely on LastHttpContent message.
+- if (headers.contains(HttpHeaderNames.CONTENT_LENGTH)) {
+- headers.remove(HttpHeaderNames.CONTENT_LENGTH);
+- headers.set(HttpHeaderNames.TRANSFER_ENCODING, HttpHeaderValues.CHUNKED);
++ if (decoder == null) {
++ if (message instanceof HttpContent) {
++ ((HttpContent) message).retain();
+ }
+- // Either it is already chunked or EOF terminated.
+- // See https://github.com/netty/netty/issues/5892
++ needRead = false;
++ ctx.fireChannelRead(message);
++ return;
++ }
++ decoder.pipeline().addLast(forwarder);
+
+- // set new content encoding,
+- CharSequence targetContentEncoding = getTargetContentEncoding(contentEncoding);
+- if (HttpHeaderValues.IDENTITY.contentEquals(targetContentEncoding)) {
+- // Do NOT set the 'Content-Encoding' header if the target encoding is 'identity'
+- // as per: http://tools.ietf.org/html/rfc2616#section-14.11
+- headers.remove(HttpHeaderNames.CONTENT_ENCODING);
+- } else {
+- headers.set(HttpHeaderNames.CONTENT_ENCODING, targetContentEncoding);
+- }
++ // Remove content-length header:
++ // the correct value can be set only after all chunks are processed/decoded.
++ // If buffering is not an issue, add HttpObjectAggregator down the chain, it will set the header.
++ // Otherwise, rely on LastHttpContent message.
++ if (headers.contains(HttpHeaderNames.CONTENT_LENGTH)) {
++ headers.remove(HttpHeaderNames.CONTENT_LENGTH);
++ headers.set(HttpHeaderNames.TRANSFER_ENCODING, HttpHeaderValues.CHUNKED);
++ }
++ // Either it is already chunked or EOF terminated.
++ // See https://github.com/netty/netty/issues/5892
+
+- if (message instanceof HttpContent) {
+- // If message is a full request or response object (headers + data), don't copy data part into out.
+- // Output headers only; data part will be decoded below.
+- // Note: "copy" object must not be an instance of LastHttpContent class,
+- // as this would (erroneously) indicate the end of the HttpMessage to other handlers.
+- HttpMessage copy;
+- if (message instanceof HttpRequest) {
+- HttpRequest r = (HttpRequest) message; // HttpRequest or FullHttpRequest
+- copy = new DefaultHttpRequest(r.protocolVersion(), r.method(), r.uri());
+- } else if (message instanceof HttpResponse) {
+- HttpResponse r = (HttpResponse) message; // HttpResponse or FullHttpResponse
+- copy = new DefaultHttpResponse(r.protocolVersion(), r.status());
+- } else {
+- throw new CodecException("Object of class " + message.getClass().getName() +
+- " is not an HttpRequest or HttpResponse");
+- }
+- copy.headers().set(message.headers());
+- copy.setDecoderResult(message.decoderResult());
+- out.add(copy);
+- } else {
+- out.add(message);
+- }
++ // set new content encoding,
++ CharSequence targetContentEncoding = getTargetContentEncoding(contentEncoding);
++ if (HttpHeaderValues.IDENTITY.contentEquals(targetContentEncoding)) {
++ // Do NOT set the 'Content-Encoding' header if the target encoding is 'identity'
++ // as per: https://tools.ietf.org/html/rfc2616#section-14.11
++ headers.remove(HttpHeaderNames.CONTENT_ENCODING);
++ } else {
++ headers.set(HttpHeaderNames.CONTENT_ENCODING, targetContentEncoding);
+ }
+
+- if (msg instanceof HttpContent) {
+- final HttpContent c = (HttpContent) msg;
+- if (decoder == null) {
+- out.add(c.retain());
++ if (message instanceof HttpContent) {
++ // If message is a full request or response object (headers + data), don't copy data part into out.
++ // Output headers only; data part will be decoded below.
++ // Note: "copy" object must not be an instance of LastHttpContent class,
++ // as this would (erroneously) indicate the end of the HttpMessage to other handlers.
++ HttpMessage copy;
++ if (message instanceof HttpRequest) {
++ HttpRequest r = (HttpRequest) message; // HttpRequest or FullHttpRequest
++ copy = new DefaultHttpRequest(r.protocolVersion(), r.method(), r.uri());
++ } else if (message instanceof HttpResponse) {
++ HttpResponse r = (HttpResponse) message; // HttpResponse or FullHttpResponse
++ copy = new DefaultHttpResponse(r.protocolVersion(), r.status());
+ } else {
+- decodeContent(c, out);
++ throw new CodecException("Object of class " + message.getClass().getName() +
++ " is not an HttpRequest or HttpResponse");
+ }
++ copy.headers().set(message.headers());
++ copy.setDecoderResult(message.decoderResult());
++ needRead = false;
++ ctx.fireChannelRead(copy);
++ } else {
++ needRead = false;
++ ctx.fireChannelRead(message);
+ }
+- } finally {
+- needRead = out.isEmpty();
+ }
+- }
+-
+- private void decodeContent(HttpContent c, List<Object> out) {
+- ByteBuf content = c.content();
+-
+- decode(content, out);
+-
+- if (c instanceof LastHttpContent) {
+- finishDecode(out);
+
+- LastHttpContent last = (LastHttpContent) c;
+- // Generate an additional chunk if the decoder produced
+- // the last product on closure,
+- HttpHeaders headers = last.trailingHeaders();
+- if (headers.isEmpty()) {
+- out.add(LastHttpContent.EMPTY_LAST_CONTENT);
++ if (msg instanceof HttpContent) {
++ final HttpContent c = (HttpContent) msg;
++ if (decoder == null) {
++ needRead = false;
++ ctx.fireChannelRead(c.retain());
+ } else {
+- out.add(new ComposedLastHttpContent(headers, DecoderResult.SUCCESS));
++ // call retain here as it will call release after its written to the channel
++ decoder.writeInbound(c.content().retain());
++
++ if (c instanceof LastHttpContent) {
++ boolean notEmpty = decoder.finish();
++ decoder = null;
++ assert !notEmpty;
++ LastHttpContent last = (LastHttpContent) c;
++ // Generate an additional chunk if the decoder produced
++ // the last product on closure,
++ HttpHeaders headers = last.trailingHeaders();
++ needRead = false;
++ if (headers.isEmpty()) {
++ ctx.fireChannelRead(LastHttpContent.EMPTY_LAST_CONTENT);
++ } else {
++ ctx.fireChannelRead(new ComposedLastHttpContent(headers, DecoderResult.SUCCESS));
++ }
++ }
+ }
+ }
+ }
+@@ -228,6 +240,7 @@ public abstract class HttpContentDecoder extends MessageToMessageDecoder<HttpObj
+ @Override
+ public void handlerAdded(ChannelHandlerContext ctx) throws Exception {
+ this.ctx = ctx;
++ forwarder = new ByteBufForwarder(ctx);
+ super.handlerAdded(ctx);
+ }
+
+@@ -249,30 +262,30 @@ public abstract class HttpContentDecoder extends MessageToMessageDecoder<HttpObj
+ }
+ }
+
+- private void decode(ByteBuf in, List<Object> out) {
+- // call retain here as it will call release after its written to the channel
+- decoder.writeInbound(in.retain());
+- fetchDecoderOutput(out);
+- }
++ private final class ByteBufForwarder extends ChannelInboundHandlerAdapter {
++
++ private final ChannelHandlerContext targetCtx;
+
+- private void finishDecode(List<Object> out) {
+- if (decoder.finish()) {
+- fetchDecoderOutput(out);
++ ByteBufForwarder(ChannelHandlerContext targetCtx) {
++ this.targetCtx = targetCtx;
+ }
+- decoder = null;
+- }
+
+- private void fetchDecoderOutput(List<Object> out) {
+- for (;;) {
+- ByteBuf buf = decoder.readInbound();
+- if (buf == null) {
+- break;
+- }
++ @Override
++ public boolean isSharable() {
++ // We need to mark the handler as sharable as we will add it to every EmbeddedChannel that is
++ // generated.
++ return true;
++ }
++
++ @Override
++ public void channelRead(ChannelHandlerContext ctx, Object msg) {
++ ByteBuf buf = (ByteBuf) msg;
+ if (!buf.isReadable()) {
+ buf.release();
+- continue;
++ return;
+ }
+- out.add(new DefaultHttpContent(buf));
++ needRead = false;
++ targetCtx.fireChannelRead(new DefaultHttpContent(buf));
+ }
+ }
+ }
+diff --git a/codec-http/src/test/java/io/netty/handler/codec/http/HttpContentDecompressorTest.java b/codec-http/src/test/java/io/netty/handler/codec/http/HttpContentDecompressorTest.java
+index 4a659fa..f54e98d 100644
+--- a/codec-http/src/test/java/io/netty/handler/codec/http/HttpContentDecompressorTest.java
++++ b/codec-http/src/test/java/io/netty/handler/codec/http/HttpContentDecompressorTest.java
+@@ -15,6 +15,9 @@
+ */
+ package io.netty.handler.codec.http;
+
++import io.netty.buffer.AdaptiveByteBufAllocator;
++import io.netty.buffer.ByteBuf;
++import io.netty.buffer.PooledByteBufAllocator;
+ import io.netty.buffer.Unpooled;
+ import io.netty.channel.ChannelHandlerContext;
+ import io.netty.channel.ChannelInboundHandlerAdapter;
+@@ -23,6 +26,8 @@ import io.netty.channel.embedded.EmbeddedChannel;
+ import org.junit.Assert;
+ import org.junit.Test;
+
++import java.util.ArrayList;
++import java.util.List;
+ import java.util.concurrent.atomic.AtomicInteger;
+
+ public class HttpContentDecompressorTest {
+@@ -67,4 +72,87 @@ public class HttpContentDecompressorTest {
+ Assert.assertEquals(2, readCalled.get());
+ Assert.assertFalse(channel.finishAndReleaseAll());
+ }
++
++ static String[] encodings() {
++ List<String> encodings = new ArrayList<String>();
++ encodings.add("gzip");
++ encodings.add("deflate");
++ encodings.add("snappy");
++ return encodings.toArray(new String[0]);
++ }
++
++ @ParameterizedTest
++ @MethodSource("encodings")
++ public void testZipBomb(String encoding) {
++ int chunkSize = 1024 * 1024;
++ int numberOfChunks = 256;
++ int memoryLimit = chunkSize * 128;
++
++ EmbeddedChannel compressionChannel = new EmbeddedChannel(new HttpContentCompressor());
++ DefaultFullHttpRequest req = new DefaultFullHttpRequest(HttpVersion.HTTP_1_1, HttpMethod.GET, "/");
++ req.headers().set(HttpHeaderNames.ACCEPT_ENCODING, encoding);
++ compressionChannel.writeInbound(req);
++
++ DefaultHttpResponse response = new DefaultHttpResponse(HttpVersion.HTTP_1_1, HttpResponseStatus.OK);
++ response.headers().set(HttpHeaderNames.TRANSFER_ENCODING, HttpHeaderValues.CHUNKED);
++ compressionChannel.writeOutbound(response);
++
++ for (int i = 0; i < numberOfChunks; i++) {
++ ByteBuf buffer = compressionChannel.alloc().buffer(chunkSize);
++ buffer.writeZero(chunkSize);
++ compressionChannel.writeOutbound(new DefaultHttpContent(buffer));
++ }
++ compressionChannel.writeOutbound(LastHttpContent.EMPTY_LAST_CONTENT);
++ compressionChannel.finish();
++ compressionChannel.releaseInbound();
++
++ ByteBuf compressed = compressionChannel.alloc().buffer();
++ HttpMessage message = null;
++ while (true) {
++ HttpObject obj = compressionChannel.readOutbound();
++ if (obj == null) {
++ break;
++ }
++ if (obj instanceof HttpMessage) {
++ message = (HttpMessage) obj;
++ }
++ if (obj instanceof HttpContent) {
++ HttpContent content = (HttpContent) obj;
++ compressed.writeBytes(content.content());
++ content.release();
++ }
++ }
++
++ PooledByteBufAllocator allocator = new PooledByteBufAllocator(false);
++
++ ZipBombIncomingHandler incomingHandler = new ZipBombIncomingHandler(memoryLimit);
++ EmbeddedChannel decompressChannel = new EmbeddedChannel(new HttpContentDecompressor(0), incomingHandler);
++ decompressChannel.config().setAllocator(allocator);
++ decompressChannel.writeInbound(message);
++ decompressChannel.writeInbound(new DefaultLastHttpContent(compressed));
++
++ assertEquals((long) chunkSize * numberOfChunks, incomingHandler.total);
++ }
++
++ private static final class ZipBombIncomingHandler extends ChannelInboundHandlerAdapter {
++ final int memoryLimit;
++ long total;
++
++ ZipBombIncomingHandler(int memoryLimit) {
++ this.memoryLimit = memoryLimit;
++ }
++
++ @Override
++ public void channelRead(ChannelHandlerContext ctx, Object msg) {
++ PooledByteBufAllocator allocator = (PooledByteBufAllocator) ctx.alloc();
++ assertTrue(allocator.metric().usedHeapMemory() < memoryLimit);
++ assertTrue(allocator.metric().usedDirectMemory() < memoryLimit);
++
++ if (msg instanceof HttpContent) {
++ HttpContent buf = (HttpContent) msg;
++ total += buf.content().readableBytes();
++ buf.release();
++ }
++ }
++ }
+ }
+diff --git a/codec-http2/src/main/java/io/netty/handler/codec/http2/DelegatingDecompressorFrameListener.java b/codec-http2/src/main/java/io/netty/handler/codec/http2/DelegatingDecompressorFrameListener.java
+index 6793f28..af15318 100644
+--- a/codec-http2/src/main/java/io/netty/handler/codec/http2/DelegatingDecompressorFrameListener.java
++++ b/codec-http2/src/main/java/io/netty/handler/codec/http2/DelegatingDecompressorFrameListener.java
+@@ -17,6 +17,7 @@ package io.netty.handler.codec.http2;
+ import io.netty.buffer.ByteBuf;
+ import io.netty.buffer.Unpooled;
+ import io.netty.channel.ChannelHandlerContext;
++import io.netty.channel.ChannelInboundHandlerAdapter;
+ import io.netty.channel.embedded.EmbeddedChannel;
+ import io.netty.handler.codec.ByteToMessageDecoder;
+ import io.netty.handler.codec.compression.ZlibCodecFactory;
+@@ -63,7 +64,7 @@ public class DelegatingDecompressorFrameListener extends Http2FrameListenerDecor
+ public void onStreamRemoved(Http2Stream stream) {
+ final Http2Decompressor decompressor = decompressor(stream);
+ if (decompressor != null) {
+- cleanup(decompressor);
++ decompressor.cleanup();
+ }
+ }
+ });
+@@ -78,66 +79,7 @@ public class DelegatingDecompressorFrameListener extends Http2FrameListenerDecor
+ // The decompressor may be null if no compatible encoding type was found in this stream's headers
+ return listener.onDataRead(ctx, streamId, data, padding, endOfStream);
+ }
+-
+- final EmbeddedChannel channel = decompressor.decompressor();
+- final int compressedBytes = data.readableBytes() + padding;
+- decompressor.incrementCompressedBytes(compressedBytes);
+- try {
+- // call retain here as it will call release after its written to the channel
+- channel.writeInbound(data.retain());
+- ByteBuf buf = nextReadableBuf(channel);
+- if (buf == null && endOfStream && channel.finish()) {
+- buf = nextReadableBuf(channel);
+- }
+- if (buf == null) {
+- if (endOfStream) {
+- listener.onDataRead(ctx, streamId, Unpooled.EMPTY_BUFFER, padding, true);
+- }
+- // No new decompressed data was extracted from the compressed data. This means the application could
+- // not be provided with data and thus could not return how many bytes were processed. We will assume
+- // there is more data coming which will complete the decompression block. To allow for more data we
+- // return all bytes to the flow control window (so the peer can send more data).
+- decompressor.incrementDecompressedBytes(compressedBytes);
+- return compressedBytes;
+- }
+- try {
+- Http2LocalFlowController flowController = connection.local().flowController();
+- decompressor.incrementDecompressedBytes(padding);
+- for (;;) {
+- ByteBuf nextBuf = nextReadableBuf(channel);
+- boolean decompressedEndOfStream = nextBuf == null && endOfStream;
+- if (decompressedEndOfStream && channel.finish()) {
+- nextBuf = nextReadableBuf(channel);
+- decompressedEndOfStream = nextBuf == null;
+- }
+-
+- decompressor.incrementDecompressedBytes(buf.readableBytes());
+- // Immediately return the bytes back to the flow controller. ConsumedBytesConverter will convert
+- // from the decompressed amount which the user knows about to the compressed amount which flow
+- // control knows about.
+- flowController.consumeBytes(stream,
+- listener.onDataRead(ctx, streamId, buf, padding, decompressedEndOfStream));
+- if (nextBuf == null) {
+- break;
+- }
+-
+- padding = 0; // Padding is only communicated once on the first iteration.
+- buf.release();
+- buf = nextBuf;
+- }
+- // We consume bytes each time we call the listener to ensure if multiple frames are decompressed
+- // that the bytes are accounted for immediately. Otherwise the user may see an inconsistent state of
+- // flow control.
+- return 0;
+- } finally {
+- buf.release();
+- }
+- } catch (Http2Exception e) {
+- throw e;
+- } catch (Throwable t) {
+- throw streamError(stream.id(), INTERNAL_ERROR, t,
+- "Decompressor error detected while delegating data read on streamId %d", stream.id());
+- }
++ return decompressor.decompress(ctx, stream, data, padding, endOfStream);
+ }
+
+ @Override
+@@ -218,7 +160,7 @@ public class DelegatingDecompressorFrameListener extends Http2FrameListenerDecor
+ }
+ final EmbeddedChannel channel = newContentDecompressor(ctx, contentEncoding);
+ if (channel != null) {
+- decompressor = new Http2Decompressor(channel);
++ decompressor = new Http2Decompressor(channel, connection, listener);
+ stream.setProperty(propertyKey, decompressor);
+ // Decode the content and remove or replace the existing headers
+ // so that the message looks like a decoded message.
+@@ -250,36 +192,6 @@ public class DelegatingDecompressorFrameListener extends Http2FrameListenerDecor
+ return stream == null ? null : (Http2Decompressor) stream.getProperty(propertyKey);
+ }
+
+- /**
+- * Release remaining content from the {@link EmbeddedChannel}.
+- *
+- * @param decompressor The decompressor for {@code stream}
+- */
+- private static void cleanup(Http2Decompressor decompressor) {
+- decompressor.decompressor().finishAndReleaseAll();
+- }
+-
+- /**
+- * Read the next decompressed {@link ByteBuf} from the {@link EmbeddedChannel}
+- * or {@code null} if one does not exist.
+- *
+- * @param decompressor The channel to read from
+- * @return The next decoded {@link ByteBuf} from the {@link EmbeddedChannel} or {@code null} if one does not exist
+- */
+- private static ByteBuf nextReadableBuf(EmbeddedChannel decompressor) {
+- for (;;) {
+- final ByteBuf buf = decompressor.readInbound();
+- if (buf == null) {
+- return null;
+- }
+- if (!buf.isReadable()) {
+- buf.release();
+- continue;
+- }
+- return buf;
+- }
+- }
+-
+ /**
+ * A decorator around the local flow controller that converts consumed bytes from uncompressed to compressed.
+ */
+@@ -360,24 +272,93 @@ public class DelegatingDecompressorFrameListener extends Http2FrameListenerDecor
+ */
+ private static final class Http2Decompressor {
+ private final EmbeddedChannel decompressor;
++
+ private int compressed;
+ private int decompressed;
++ private Http2Stream stream;
++ private int padding;
++ private boolean dataDecompressed;
++ private ChannelHandlerContext targetCtx;
+
+- Http2Decompressor(EmbeddedChannel decompressor) {
++ Http2Decompressor(EmbeddedChannel decompressor,
++ final Http2Connection connection, final Http2FrameListener listener) {
+ this.decompressor = decompressor;
++ this.decompressor.pipeline().addLast(new ChannelInboundHandlerAdapter() {
++ @Override
++ public void channelRead(ChannelHandlerContext ctx, Object msg) throws Exception {
++ ByteBuf buf = (ByteBuf) msg;
++ if (!buf.isReadable()) {
++ buf.release();
++ return;
++ }
++ incrementDecompressedBytes(buf.readableBytes());
++ // Immediately return the bytes back to the flow controller. ConsumedBytesConverter will convert
++ // from the decompressed amount which the user knows about to the compressed amount which flow
++ // control knows about.
++ connection.local().flowController().consumeBytes(stream,
++ listener.onDataRead(targetCtx, stream.id(), buf, padding, false));
++ padding = 0; // Padding is only communicated once on the first iteration.
++ buf.release();
++
++ dataDecompressed = true;
++ }
++
++ @Override
++ public void channelInactive(ChannelHandlerContext ctx) throws Exception {
++ listener.onDataRead(targetCtx, stream.id(), Unpooled.EMPTY_BUFFER, padding, true);
++ }
++ });
+ }
+
+ /**
+- * Responsible for taking compressed bytes in and producing decompressed bytes.
++ * Release remaining content from the {@link EmbeddedChannel}.
+ */
+- EmbeddedChannel decompressor() {
+- return decompressor;
++ void cleanup() {
++ decompressor.finishAndReleaseAll();
+ }
+
++ int decompress(ChannelHandlerContext ctx, Http2Stream stream, ByteBuf data, int padding, boolean endOfStream)
++ throws Http2Exception {
++ final int compressedBytes = data.readableBytes() + padding;
++ incrementCompressedBytes(compressedBytes);
++ try {
++ this.stream = stream;
++ this.padding = padding;
++ this.dataDecompressed = false;
++ this.targetCtx = ctx;
++
++ // call retain here as it will call release after its written to the channel
++ decompressor.writeInbound(data.retain());
++ if (endOfStream) {
++ decompressor.finish();
++
++ if (!dataDecompressed) {
++ // No new decompressed data was extracted from the compressed data. This means the application
++ // could not be provided with data and thus could not return how many bytes were processed.
++ // We will assume there is more data coming which will complete the decompression block.
++ // To allow for more data we return all bytes to the flow control window (so the peer can
++ // send more data).
++ incrementDecompressedBytes(compressedBytes);
++ return compressedBytes;
++ }
++ }
++ // We consume bytes each time we call the listener to ensure if multiple frames are decompressed
++ // that the bytes are accounted for immediately. Otherwise the user may see an inconsistent state of
++ // flow control.
++ return 0;
++ } catch (Throwable t) {
++ // Http2Exception might be thrown by writeInbound(...) or finish().
++ if (t instanceof Http2Exception) {
++ throw (Http2Exception) t;
++ }
++ throw streamError(stream.id(), INTERNAL_ERROR, t,
++ "Decompressor error detected while delegating data read on streamId %d", stream.id());
++ }
++ }
+ /**
+ * Increment the number of bytes received prior to doing any decompression.
+ */
+- void incrementCompressedBytes(int delta) {
++ private void incrementCompressedBytes(int delta) {
+ assert delta >= 0;
+ compressed += delta;
+ }
+@@ -385,7 +366,7 @@ public class DelegatingDecompressorFrameListener extends Http2FrameListenerDecor
+ /**
+ * Increment the number of bytes after the decompression process.
+ */
+- void incrementDecompressedBytes(int delta) {
++ private void incrementDecompressedBytes(int delta) {
+ assert delta >= 0;
+ decompressed += delta;
+ }
+diff --git a/codec/src/main/java/io/netty/handler/codec/compression/JZlibDecoder.java b/codec/src/main/java/io/netty/handler/codec/compression/JZlibDecoder.java
+index 6c65cd5..9bc684e 100644
+--- a/codec/src/main/java/io/netty/handler/codec/compression/JZlibDecoder.java
++++ b/codec/src/main/java/io/netty/handler/codec/compression/JZlibDecoder.java
+@@ -28,6 +28,7 @@ public class JZlibDecoder extends ZlibDecoder {
+
+ private final Inflater z = new Inflater();
+ private byte[] dictionary;
++ private boolean needsRead;
+ private volatile boolean finished;
+
+ /**
+@@ -125,6 +126,7 @@ public class JZlibDecoder extends ZlibDecoder {
+
+ @Override
+ protected void decode(ChannelHandlerContext ctx, ByteBuf in, List<Object> out) throws Exception {
++ needsRead = true;
+ if (finished) {
+ // Skip data received after finished.
+ in.skipBytes(in.readableBytes());
+@@ -166,6 +168,14 @@ public class JZlibDecoder extends ZlibDecoder {
+ int outputLength = z.next_out_index - oldNextOutIndex;
+ if (outputLength > 0) {
+ decompressed.writerIndex(decompressed.writerIndex() + outputLength);
++ if (maxAllocation == 0) {
++ // If we don't limit the maximum allocations we should just
++ // forward the buffer directly.
++ ByteBuf buffer = decompressed;
++ decompressed = null;
++ needsRead = false;
++ ctx.fireChannelRead(buffer);
++ }
+ }
+
+ switch (resultCode) {
+@@ -196,10 +206,13 @@ public class JZlibDecoder extends ZlibDecoder {
+ }
+ } finally {
+ in.skipBytes(z.next_in_index - oldNextInIndex);
+- if (decompressed.isReadable()) {
+- out.add(decompressed);
+- } else {
+- decompressed.release();
++ if (decompressed != null) {
++ if (decompressed.isReadable()) {
++ needsRead = false;
++ ctx.fireChannelRead(decompressed);
++ } else {
++ decompressed.release();
++ }
+ }
+ }
+ } finally {
+@@ -212,6 +225,17 @@ public class JZlibDecoder extends ZlibDecoder {
+ }
+ }
+
++ @Override
++ public void channelReadComplete(ChannelHandlerContext ctx) throws Exception {
++ // Discard bytes of the cumulation buffer if needed.
++ discardSomeReadBytes();
++
++ if (needsRead && !ctx.channel().config().isAutoRead()) {
++ ctx.read();
++ }
++ ctx.fireChannelReadComplete();
++ }
++
+ @Override
+ protected void decompressionBufferExhausted(ByteBuf buffer) {
+ finished = true;
+diff --git a/codec/src/main/java/io/netty/handler/codec/compression/JdkZlibDecoder.java b/codec/src/main/java/io/netty/handler/codec/compression/JdkZlibDecoder.java
+index 7e69422..426b84e 100644
+--- a/codec/src/main/java/io/netty/handler/codec/compression/JdkZlibDecoder.java
++++ b/codec/src/main/java/io/netty/handler/codec/compression/JdkZlibDecoder.java
+@@ -57,6 +57,7 @@ public class JdkZlibDecoder extends ZlibDecoder {
+ private GzipState gzipState = GzipState.HEADER_START;
+ private int flags = -1;
+ private int xlen = -1;
++ private boolean needsRead;
+
+ private volatile boolean finished;
+
+@@ -178,6 +179,7 @@ public class JdkZlibDecoder extends ZlibDecoder {
+
+ @Override
+ protected void decode(ChannelHandlerContext ctx, ByteBuf in, List<Object> out) throws Exception {
++ needsRead = true;
+ if (finished) {
+ // Skip data received after finished.
+ in.skipBytes(in.readableBytes());
+@@ -239,14 +241,20 @@ public class JdkZlibDecoder extends ZlibDecoder {
+ if (crc != null) {
+ crc.update(outArray, outIndex, outputLength);
+ }
+- } else {
+- if (inflater.needsDictionary()) {
+- if (dictionary == null) {
+- throw new DecompressionException(
+- "decompression failure, unable to set dictionary as non was specified");
+- }
+- inflater.setDictionary(dictionary);
++ if (maxAllocation == 0) {
++ // If we don't limit the maximum allocations we should just
++ // forward the buffer directly.
++ ByteBuf buffer = decompressed;
++ decompressed = null;
++ needsRead = false;
++ ctx.fireChannelRead(buffer);
++ }
++ } else if (inflater.needsDictionary()) {
++ if (dictionary == null) {
++ throw new DecompressionException(
++ "decompression failure, unable to set dictionary as non was specified");
+ }
++ inflater.setDictionary(dictionary);
+ }
+
+ if (inflater.finished()) {
+@@ -278,11 +286,13 @@ public class JdkZlibDecoder extends ZlibDecoder {
+ } catch (DataFormatException e) {
+ throw new DecompressionException("decompression failure", e);
+ } finally {
+-
+- if (decompressed.isReadable()) {
+- out.add(decompressed);
+- } else {
+- decompressed.release();
++ if (decompressed != null) {
++ if (decompressed.isReadable()) {
++ needsRead = false;
++ ctx.fireChannelRead(decompressed);
++ } else {
++ decompressed.release();
++ }
+ }
+ }
+ }
+@@ -454,4 +464,15 @@ public class JdkZlibDecoder extends ZlibDecoder {
+ return (cmf_flg & 0x7800) == 0x7800 &&
+ cmf_flg % 31 == 0;
+ }
++
++ @Override
++ public void channelReadComplete(ChannelHandlerContext ctx) throws Exception {
++ // Discard bytes of the cumulation buffer if needed.
++ discardSomeReadBytes();
++
++ if (needsRead && !ctx.channel().config().isAutoRead()) {
++ ctx.read();
++ }
++ ctx.fireChannelReadComplete();
++ }
+ }
+diff --git a/codec/src/test/java/io/netty/handler/codec/compression/AbstractIntegrationTest.java b/codec/src/test/java/io/netty/handler/codec/compression/AbstractIntegrationTest.java
+index 5eaed2f..dc05eb6 100644
+--- a/codec/src/test/java/io/netty/handler/codec/compression/AbstractIntegrationTest.java
++++ b/codec/src/test/java/io/netty/handler/codec/compression/AbstractIntegrationTest.java
+@@ -17,7 +17,10 @@ package io.netty.handler.codec.compression;
+
+ import io.netty.buffer.ByteBuf;
+ import io.netty.buffer.CompositeByteBuf;
++import io.netty.buffer.PooledByteBufAllocator;
+ import io.netty.buffer.Unpooled;
++import io.netty.channel.ChannelHandlerContext;
++import io.netty.channel.ChannelInboundHandlerAdapter;
+ import io.netty.channel.embedded.EmbeddedChannel;
+ import io.netty.util.CharsetUtil;
+ import io.netty.util.ReferenceCountUtil;
+@@ -166,4 +169,63 @@ public abstract class AbstractIntegrationTest {
+ decompressed.release();
+ in.release();
+ }
++
++ @Test
++ public void testHugeDecompress() {
++ int chunkSize = 1024 * 1024;
++ int numberOfChunks = 256;
++ int memoryLimit = chunkSize * 128;
++
++ EmbeddedChannel compressChannel = createEncoder();
++ ByteBuf compressed = compressChannel.alloc().buffer();
++ for (int i = 0; i <= numberOfChunks; i++) {
++ if (i < numberOfChunks) {
++ ByteBuf in = compressChannel.alloc().buffer(chunkSize);
++ in.writeZero(chunkSize);
++ compressChannel.writeOutbound(in);
++ } else {
++ compressChannel.close();
++ }
++ while (true) {
++ ByteBuf buf = compressChannel.readOutbound();
++ if (buf == null) {
++ break;
++ }
++ compressed.writeBytes(buf);
++ buf.release();
++ }
++ }
++
++ PooledByteBufAllocator allocator = new PooledByteBufAllocator(false);
++
++ HugeDecompressIncomingHandler endHandler = new HugeDecompressIncomingHandler(memoryLimit);
++ EmbeddedChannel decompressChannel = createDecoder();
++ decompressChannel.pipeline().addLast(endHandler);
++ decompressChannel.config().setAllocator(allocator);
++ decompressChannel.writeInbound(compressed);
++ decompressChannel.finishAndReleaseAll();
++ assertEquals((long) chunkSize * numberOfChunks, endHandler.total);
++ }
++
++ private static final class HugeDecompressIncomingHandler extends ChannelInboundHandlerAdapter {
++ final int memoryLimit;
++ long total;
++
++ HugeDecompressIncomingHandler(int memoryLimit) {
++ this.memoryLimit = memoryLimit;
++ }
++
++ @Override
++ public void channelRead(ChannelHandlerContext ctx, Object msg) {
++ ByteBuf buf = (ByteBuf) msg;
++ total += buf.readableBytes();
++ try {
++ PooledByteBufAllocator allocator = (PooledByteBufAllocator) ctx.alloc();
++ assertThat(allocator.metric().usedHeapMemory()).isLessThan(memoryLimit);
++ assertThat(allocator.metric().usedDirectMemory()).isLessThan(memoryLimit);
++ } finally {
++ buf.release();
++ }
++ }
++ }
+ }
=====================================
debian/patches/series
=====================================
@@ -29,3 +29,4 @@ CVE-2025-59419.patch
CVE-2025-55163_before-1.patch
CVE-2025-55163_1.patch
CVE-2025-55163_2.patch
+CVE-2025-58057.patch
View it on GitLab: https://salsa.debian.org/java-team/netty/-/commit/8c1e2f3cba8b38df63b0e3e5586e935e9eac0292
--
View it on GitLab: https://salsa.debian.org/java-team/netty/-/commit/8c1e2f3cba8b38df63b0e3e5586e935e9eac0292
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-commits/attachments/20251116/33505f49/attachment.htm>
More information about the pkg-java-commits
mailing list