CFE_FS_Decompress infinite loop on truncated gzip file #298
Description
If CFS_FS_Decompress is given a truncated gzip file, it will enter an infinite loop in which it attempts to read more data from the file, gets nothing, and tries again. Discovered by accidentally attempting to have ES load a new compressed application (which we didn't know had been truncated), which led to ES getting stuck and an eventual watchdog reset.
The problem seems to be that running out of bytes in a gzipped file before decompression is finished is not considered an error. I can see how this might be intentional if it is expected that the file handle might be a stream that could present data after being emptied, but for the normal file use case I think it is a bug. Suggested fix by combining the two checks at line 309 of cfe_fs_decompress.c:
if ( State->insize == 0 ) return EOF;
if ( len == OS_FS_ERROR )
{
State->Error = CFE_FS_GZIP_READ_ERROR;
return EOF;
}
into one:
if ((State->insize == 0) !|| (len == OS_FS_ERROR)) {
State->Error = CFE_FS_GZIP_READ_ERROR;
return EOF;
}
Recommend investigation if insize might temporarily hit 0 during a normal decompression.
Reported via email from Mike Stewart, mike@capellaspace.com