[Zope-Checkins] CVS: Releases/Zope/lib/python/ZTUtils - Tree.py:1.17

[Evan Simpson]

Update of /cvs-repository/Releases/Zope/lib/python/ZTUtils
In directory cvs.zope.org:/tmp/cvs-serv11122/lib/python/ZTUtils

Modified Files:
	Tree.py 
Log Message:
Collector #1012: A carefully crafted compressed tree state could violate size limit.  Limit is no longer hardcoded.


=== Releases/Zope/lib/python/ZTUtils/Tree.py 1.16 => 1.17 ===
--- Releases/Zope/lib/python/ZTUtils/Tree.py:1.16	Tue Jul 15 13:01:56 2003
+++ Releases/Zope/lib/python/ZTUtils/Tree.py	Thu Dec 11 13:02:15 2003
@@ -277,16 +277,19 @@
             result = zresult
     return result
 
-def decodeExpansion(s, nth=None):
+def decodeExpansion(s, nth=None, maxsize=8192):
     '''Decode an expanded node map from a string.
 
     If nth is an integer, also return the (map, key) pair for the nth entry.
     '''
-    if len(s) > 8192: # Set limit to 8K, to avoid DoS attacks.
+    if len(s) > maxsize: # Set limit to avoid DoS attacks.
         raise ValueError('Encoded node map too large')
 
     if s[0] == ':': # Compressed state
-        s = zlib.decompress(a2b(s[1:]))
+        dec = zlib.decompressobj()
+        s = dec.decompress(a2b(s[1:]), maxsize)
+        if dec.decompress('', 1):
+            raise ValueError('Encoded node map too large')
     
     map = m = {}
     mstack = []