bodgit / sevenzip / 26005223127

75%

main: 75%

Pull #448

github

Protect against specially crafted archives setting high AES cycles

add maxCyclesPower to cap the number of cycles.
add tests to validate behavior

Cycles setting comes directly from the archive's AES properties byte
which could be set to something like cycles=62 which would mean 2^62 ≈
4.6×10^18 SHA-256 iterations, which would effectively hang the process.
Standard 7-zip archives use cycles=19 so setting the cap to 24 gives
headroom to the standard while still protecting from a malicious file

4 of 4 new or added lines in 1 file covered. (100.0%)

1825 of 2434 relevant lines covered (74.98%)

0.84 hits per line