Node / meshtastic / Meshtastic-Android / files / feature / firmware / src / jvmAndroidMain / kotlin / org / meshtastic / feature / firmware / ZipExtraction.kt

Displaying Raw • Download

T8b949e/*

* Copyright (c) 2026 Meshtastic LLC

*

* This program is free software: you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation, either version 3 of the License, or

* (at your option) any later version.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program. If not, see <https://www.gnu.org/licenses/>.

*/

Tff7b72package T7ee787org.meshtastic.feature.firmware

Tff7b72import T7ee787java.io.ByteArrayOutputStream

Tff7b72import T7ee787java.io.FilterInputStream

Tff7b72import T7ee787java.io.InputStream

Tff7b72import T7ee787java.util.zip.ZipInputStream

T8b949e/**

* Ceiling on a firmware archive as delivered. Real Meshtastic release zips are tens of MB, and the whole archive is

* streamed rather than buffered, so this only needs to reject something implausible.

*/

Tff7b72internal Tff7b72const Tff7b72val Te6edf3MAX_FIRMWARE_ZIP_BYTES Tff7b72= T79c0ff1T79c0ff2T79c0ff8L Tff7b72* T79c0ff1T79c0ff0T79c0ff2T79c0ff4 Tff7b72* T79c0ff1T79c0ff0T79c0ff2T79c0ff4

T8b949e/**

* Ceiling on total inflated bytes held in memory across all entries.

*

* This is the bound that matters: a highly compressible archive is small on the wire and enormous once inflated, and

* every entry is retained in the returned map at once.

*/

Tff7b72internal Tff7b72const Tff7b72val Te6edf3MAX_FIRMWARE_UNCOMPRESSED_BYTES Tff7b72= T79c0ff9T79c0ff6L Tff7b72* T79c0ff1T79c0ff0T79c0ff2T79c0ff4 Tff7b72* T79c0ff1T79c0ff0T79c0ff2T79c0ff4

T8b949e/** Ceiling on entry count. A release archive holds a few hundred at most. */

Tff7b72internal Tff7b72const Tff7b72val Te6edf3MAX_FIRMWARE_ZIP_ENTRIES Tff7b72= T79c0ff4T79c0ff0T79c0ff9T79c0ff6

Tff7b72private Tff7b72const Tff7b72val Te6edf3COPY_BUFFER_SIZE Tff7b72= T79c0ff8T79c0ff1T79c0ff9T79c0ff2

T8b949e/**

* Fails once more than [limit] bytes have been pulled from [delegate].

*

* Bounds the *compressed* side. Without it the only limit on how much of an archive gets read is a declared size, and

* `getFileSize` reports 0 for a content provider that declines to answer — exactly the untrusted case. The

* inflated-byte budget alone doesn't cover this, because it constrains output rather than input.

*/

Tff7b72private Tff7b72class T56d364LimitedInputStreamTb4b4b4(Te6edf3delegateTb4b4b4: Te6edf3InputStreamTb4b4b4, Tff7b72private Tff7b72val Te6edf3limitTb4b4b4: Tffa657LongTb4b4b4) Tb4b4b4: Te6edf3FilterInputStreamTb4b4b4(Te6edf3delegateTb4b4b4) Tb4b4b4{

Tff7b72private Tff7b72var Te6edf3consumed Tff7b72= T79c0ff0L

Tff7b72private Tff7b72fun Td2a8ffchargeTb4b4b4(Te6edf3bytesTb4b4b4: Tffa657LongTb4b4b4) Tb4b4b4{

Te6edf3consumed Tff7b72+Tff7b72= Te6edf3bytes

Te6edf3requireTb4b4b4(Te6edf3consumed Tff7b72<Tff7b72= Te6edf3limitTb4b4b4) Tb4b4b4{ Ta5d6ff"Ta5d6ffFirmware archive reads past the Tffd700$Te6edf3limitTa5d6ff-byte transfer limitTa5d6ff" Tb4b4b4}

Tb4b4b4}

Tff7b72override Tff7b72fun Td2a8ffreadTb4b4b4(Tb4b4b4)Tb4b4b4: Tffa657Int Tff7b72= Tff7b72superTb4b4b4.Te6edf3readTb4b4b4(Tb4b4b4)Tb4b4b4.Te6edf3also Tb4b4b4{ Tff7b72if Tb4b4b4(Tffa657it Tff7b72>Tff7b72= T79c0ff0Tb4b4b4) Te6edf3chargeTb4b4b4(T79c0ff1Tb4b4b4) Tb4b4b4}

Tff7b72override Tff7b72fun Td2a8ffreadTb4b4b4(Te6edf3bTb4b4b4: Te6edf3ByteArrayTb4b4b4, Te6edf3offTb4b4b4: Tffa657IntTb4b4b4, Te6edf3lenTb4b4b4: Tffa657IntTb4b4b4)Tb4b4b4: Tffa657Int Tff7b72=

Tff7b72superTb4b4b4.Te6edf3readTb4b4b4(Te6edf3bTb4b4b4, Te6edf3offTb4b4b4, Te6edf3lenTb4b4b4)Tb4b4b4.Te6edf3also Tb4b4b4{ Tff7b72if Tb4b4b4(Tffa657it Tff7b72> T79c0ff0Tb4b4b4) Te6edf3chargeTb4b4b4(Tffa657itTb4b4b4.Te6edf3toLongTb4b4b4(Tb4b4b4)Tb4b4b4) Tb4b4b4}

Tb4b4b4}

T8b949e/**

* Reads at most [limit] bytes from [input], returning null if the source has more than that.

*

* Reads incrementally and stops as soon as the limit is passed, so the caller never materialises more than `limit +

* `[COPY_BUFFER_SIZE] bytes regardless of how large the source claims or turns out to be. Checking a size *after*

* reading an entry fully — the obvious-looking version of this — provides no protection at all, because the allocation

* that exhausts the heap has already happened by the time the check runs.

*/

Tff7b72internal Tff7b72fun Td2a8ffreadAtMostTb4b4b4(Te6edf3inputTb4b4b4: Te6edf3InputStreamTb4b4b4, Te6edf3limitTb4b4b4: Tffa657LongTb4b4b4)Tb4b4b4: Te6edf3ByteArray? Tb4b4b4{

Tff7b72val Te6edf3out Tff7b72= Te6edf3ByteArrayOutputStreamTb4b4b4(Tb4b4b4)

Tff7b72val Te6edf3buffer Tff7b72= Te6edf3ByteArrayTb4b4b4(Te6edf3COPY_BUFFER_SIZETb4b4b4)

Tff7b72var Te6edf3total Tff7b72= T79c0ff0L

Tff7b72while Tb4b4b4(Tff7b72trueTb4b4b4) Tb4b4b4{

Tff7b72val Te6edf3read Tff7b72= Te6edf3inputTb4b4b4.Te6edf3readTb4b4b4(Te6edf3bufferTb4b4b4)

Tff7b72if Tb4b4b4(Te6edf3read Tff7b72< T79c0ff0Tb4b4b4) Tff7b72return Tff7b72outTb4b4b4.Te6edf3toByteArrayTb4b4b4(Tb4b4b4)

Te6edf3total Tff7b72+Tff7b72= Te6edf3read

Tff7b72if Tb4b4b4(Te6edf3total Tff7b72> Te6edf3limitTb4b4b4) Tff7b72return Tff7b72null

Tff7b72outTb4b4b4.Te6edf3writeTb4b4b4(Te6edf3bufferTb4b4b4, T79c0ff0Tb4b4b4, Te6edf3readTb4b4b4)

Tb4b4b4}

Tb4b4b4}

T8b949e/**

* Fully expands a zip from [input] into memory, keyed by entry name, refusing anything that would exceed the given

* bounds.

*

* Shared by the Android and desktop JVM [FirmwareFileHandler] implementations — a firmware archive is user- or

* network-supplied and every entry is held in memory simultaneously, so both need identical limits. The bounds are

* parameters so tests can drive them with small values instead of allocating hundreds of megabytes.

*

* Throws [IllegalArgumentException] when a bound is exceeded; callers surface that as a firmware-update error.

*/

Tff7b72internal Tff7b72fun Td2a8ffextractZipEntriesBoundedTb4b4b4(

Te6edf3inputTb4b4b4: Te6edf3InputStreamTb4b4b4,

Te6edf3maxEntriesTb4b4b4: Tffa657Int Tff7b72= Te6edf3MAX_FIRMWARE_ZIP_ENTRIESTb4b4b4,

Te6edf3maxTotalBytesTb4b4b4: Tffa657Long Tff7b72= Te6edf3MAX_FIRMWARE_UNCOMPRESSED_BYTESTb4b4b4,

Te6edf3maxCompressedBytesTb4b4b4: Tffa657Long Tff7b72= Te6edf3MAX_FIRMWARE_ZIP_BYTESTb4b4b4,

Tb4b4b4)Tb4b4b4: Te6edf3MapTff7b72<Tffa657StringTb4b4b4, Te6edf3ByteArrayTff7b72> Tb4b4b4{

Tff7b72val Te6edf3entries Tff7b72= Te6edf3mutableMapOfTff7b72<Tffa657StringTb4b4b4, Te6edf3ByteArrayTff7b72>Tb4b4b4(Tb4b4b4)

Tff7b72var Te6edf3remaining Tff7b72= Te6edf3maxTotalBytes

T8b949e// Counted separately from `entries.size`: duplicate names collapse to one map key, so counting the map would let

T8b949e// an archive of arbitrarily many same-named entries walk straight past the cap.

Tff7b72var Te6edf3entriesSeen Tff7b72= T79c0ff0

T8b949e// Wrapped here rather than at the call sites so neither handler can forget it.

Te6edf3ZipInputStreamTb4b4b4(Te6edf3LimitedInputStreamTb4b4b4(Te6edf3inputTb4b4b4, Te6edf3maxCompressedBytesTb4b4b4)Tb4b4b4)Tb4b4b4.Te6edf3use Tb4b4b4{ Te6edf3zip Tff7b72-Tff7b72>

Tff7b72var Te6edf3entry Tff7b72= Te6edf3zipTb4b4b4.Te6edf3nextEntry

Tff7b72while Tb4b4b4(Te6edf3entry Tff7b72!Tff7b72= Tff7b72nullTb4b4b4) Tb4b4b4{

Tff7b72if Tb4b4b4(Tff7b72!Te6edf3entryTb4b4b4.Te6edf3isDirectoryTb4b4b4) Tb4b4b4{

Te6edf3entriesSeenTff7b72+Tff7b72+

Te6edf3requireTb4b4b4(Te6edf3entriesSeen Tff7b72<Tff7b72= Te6edf3maxEntriesTb4b4b4) Tb4b4b4{ Ta5d6ff"Ta5d6ffFirmware archive has more than Tffd700$Te6edf3maxEntriesTa5d6ff entriesTa5d6ff" Tb4b4b4}

T8b949e// Bounded by whatever budget is left, so the running total cannot be exceeded by a single entry.

Tff7b72val Te6edf3bytes Tff7b72=

Te6edf3readAtMostTb4b4b4(Te6edf3zipTb4b4b4, Te6edf3remainingTb4b4b4)

Tff7b72?: Tff7b72throw Te6edf3IllegalArgumentExceptionTb4b4b4(Ta5d6ff"Ta5d6ffFirmware archive expands past the Tffd700$Te6edf3maxTotalBytesTa5d6ff-byte limitTa5d6ff"Tb4b4b4)

Te6edf3remaining Tff7b72-Tff7b72= Te6edf3bytesTb4b4b4.Te6edf3size

Te6edf3entriesTff7b72[Te6edf3entryTb4b4b4.Te6edf3nameTff7b72] Tff7b72= Te6edf3bytes

Tb4b4b4}

Te6edf3zipTb4b4b4.Te6edf3closeEntryTb4b4b4(Tb4b4b4)

Te6edf3entry Tff7b72= Te6edf3zipTb4b4b4.Te6edf3nextEntry

Tb4b4b4}

Tb4b4b4}

Tff7b72return Te6edf3entries

Tb4b4b4}