Issue #16350: Fix zlib decompressor handling of unused_data with multiple calls to decompress() after EOF.

Patch by Serhiy Storchaka.

1 files changed, 23 insertions, 6 deletions

diff --git a/Modules/zlibmodule.c b/Modules/zlibmodule.c
index 6519194fb5..888ef5388d 100644
--- a/Modules/zlibmodule.c
+++ b/Modules/zlibmodule.c
@@ -693,12 +693,29 @@ PyZlib_objdecompress(compobject *self, PyObject *args)
        preserved.
     */
     if (err == Z_STREAM_END) {
-        Py_XDECREF(self->unused_data);  /* Free original empty string */
-        self->unused_data = PyBytes_FromStringAndSize(
-            (char *)self->zst.next_in, self->zst.avail_in);
-        if (self->unused_data == NULL) {
-            Py_DECREF(RetVal);
-            goto error;
+        if (self->zst.avail_in > 0) {
+            /* Append the leftover data to the existing value of unused_data. */
+            Py_ssize_t old_size = PyBytes_GET_SIZE(self->unused_data);
+            Py_ssize_t new_size = old_size + self->zst.avail_in;
+            PyObject *new_data;
+            if (new_size <= old_size) {  /* Check for overflow. */
+                PyErr_NoMemory();
+                Py_DECREF(RetVal);
+                RetVal = NULL;
+                goto error;
+            }
+            new_data = PyBytes_FromStringAndSize(NULL, new_size);
+            if (new_data == NULL) {
+                Py_DECREF(RetVal);
+                RetVal = NULL;
+                goto error;
+            }
+            Py_MEMCPY(PyBytes_AS_STRING(new_data),
+                      PyBytes_AS_STRING(self->unused_data), old_size);
+            Py_MEMCPY(PyBytes_AS_STRING(new_data) + old_size,
+                      self->zst.next_in, self->zst.avail_in);
+            Py_DECREF(self->unused_data);
+            self->unused_data = new_data;
         }
         self->eof = 1;
         /* We will only get Z_BUF_ERROR if the output buffer was full