)]}'
{
  "commit": "f897dbf2f36a5935700b7c2d94d4681d2136b7d4",
  "tree": "ff25dd4cf2b8103804701473f04cf868bbea328c",
  "parents": [
    "9cbd578e38a5ef59f9462b61d1e03338b208cba6"
  ],
  "author": {
    "name": "Petr Viktorin",
    "email": "encukou@gmail.com",
    "time": "Mon Aug 24 11:34:41 2026"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Mon Aug 24 11:34:41 2026"
  },
  "message": "gh-156002: Bound zipfile decompression for bzip2/LZMA/Zstandard (GH-156003)\n\nPatch by @tonghuaroot.\n\nzipfile.ZipExtFile._read1() bounds the output of each decompress() call\nfor DEFLATE members by passing a max_length to zlib, but for bzip2, LZMA,\nand Zstandard members it called decompress() with no bound. A whole\ncompressed chunk was therefore expanded into a single allocation before\nthe data[:self._left] clip ran, so a consumer that deliberately reads in\nsmall chunks to limit memory (for example zf.open(name).read(8192)) was\nsilently unprotected for non-DEFLATE members. A small, spec-conformant\narchive member declaring a large uncompressed size could drive multi-GB\npeak memory.\n\n_read1() now passes a per-call bound to the non-DEFLATE decompress()\n(mirroring the DEFLATE branch) and drains the decompressor\u0027s internal\nbuffer across calls by checking needs_input before reading more\ncompressed input. zipfile\u0027s LZMADecompressor wrapper forwards max_length\nand exposes needs_input so the bound also holds for LZMA members.\n\nCo-authored-by: tonghuaroot \u003ctonghuaroot@gmail.com\u003e",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "1c6e3a9f0a9a2de95fb0f7ff7bba00809cd0f8ee",
      "old_mode": 33188,
      "old_path": "Lib/test/test_zipfile/test_core.py",
      "new_id": "fdf2cd26f8c7c6411abb2054cc6b9f45f7b821a2",
      "new_mode": 33188,
      "new_path": "Lib/test/test_zipfile/test_core.py"
    },
    {
      "type": "modify",
      "old_id": "7a81aa8f44c8f4c1fb6fb5a8d49bd17b4969b94b",
      "old_mode": 33188,
      "old_path": "Lib/zipfile/__init__.py",
      "new_id": "0accf324c90e3fd68ca9e289d5b07b9b7c7584b7",
      "new_mode": 33188,
      "new_path": "Lib/zipfile/__init__.py"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "4e49ad5ce8fa00a04b15957f8d48b51a8165b699",
      "new_mode": 33188,
      "new_path": "Misc/NEWS.d/next/Security/2026-08-18-13-54-05.gh-issue-156002.CcWXPP.rst"
    }
  ]
}