Gzip header size in gzip.Reader is limited to 512 bytes

[dim13]

What version of Go are you using (go version)?

go version go1.8.1 darwin/amd64

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN=""
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/quax/go"
GORACE=""
GOROOT="/usr/local/go"
GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64"
GCCGO="gccgo"
CC="clang"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/xw/7wjjryrx3bd760wp0p8j5q3r0000gn/T/go-build040932696=/tmp/go-build -gno-record-gcc-switches -fno-common"
CXX="clang++"
CGO_ENABLED="1"
PKG_CONFIG="pkg-config"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"

What did you do?

package main

import (
        "compress/gzip"
        "os"
)

func main() {
        fd, err := os.Open("rfc1952.gz") // Contains long comment (> 512 byte), see attached file
        if err != nil {
                panic(err)
        }
        defer fd.Close()
        z, err := gzip.NewReader(fd)
        if err != nil {
                panic(err)
        }
        defer z.Close()
}

Sample file: rfc1952.gz (comment size 25037 bytes)

More real-life samples: OpenBSD packages contain signature in gzip header. See go-1.8.tgz (comment size 62131 bytes) and all other contemporary official packages for example.

What did you expect to see?

No error, parsed gzip header and valid reader.

What did you see instead?

Error: gzip: invalid header

Error origin:

• https://golang.org/src/compress/gzip/gunzip.go#L145
• https://golang.org/src/compress/gzip/gunzip.go#L80

Error cause: gzip header is read into fixed (512 bytes) buffer. However, according to rfc1952 FNAME and FCOMMENT fields are defined as variable length zero-terminated arrays without any size limits.

[dsnet]

Thanks for filing. This is a dupe of #14639.

I've intentionally avoided fixing the issue because it can lead to security issues on many HTTP servers. It seems you've provided sufficient evidence that this should be fixed in some way. I'll bump the other issue to the Go1.10 milestone