From 4956f0e0554242b7ab50a4bef8e638ff50ced77b Mon Sep 17 00:00:00 2001 From: Josh <16180970+deadp@users.noreply.github.com> Date: Wed, 21 Oct 2026 13:58:25 +1300 Subject: [PATCH] AFF4: a truncated deflate member or chunk is an error, not short data zlib.decompress raised on a truncated stream; decompressobj does not, so check eof. Co-Authored-By: Claude Opus 5.5 --- engine/aff4.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/engine/aff4.py b/engine/aff4.py index e0b247f..4071823 100644 --- a/engine/aff4.py +++ b/engine/aff4.py @@ -436,6 +436,8 @@ def read_member(self, name, max_bytes=None): out = d.decompress(raw, e.size + 1) if len(out) > e.size: raise zlib.error("member inflates past its declared size") + if not d.eof: + raise zlib.error("member is truncated") return out except zlib.error: raise Aff4Error(_t("aff4.member_decompress_failed") % name) @@ -524,6 +526,8 @@ def _read_chunk(self, chunk_id): out = d.decompress(raw, self.chunk_size + 1) if len(out) > self.chunk_size: raise zlib.error("chunk inflates past the chunk size") + if not d.eof: + raise zlib.error("chunk is truncated") return out except zlib.error: self.findings.append(