Skip to content

gh-88300: Support .xz stream padding in lzma.decompress() and LZMAFile - #161057

Draft
gpshead wants to merge 1 commit into
python:mainfrom
gpshead:lzma-stream-padding-88300
Draft

gpshead wants to merge 1 commit into
python:mainfrom
gpshead:lzma-stream-padding-88300

Conversation

@gpshead

@gpshead gpshead commented Nov 1, 2026 •

Copy link
Copy Markdown
Member

lzma.decompress() and LZMAFile now skip .xz stream padding (a run of null bytes whose size is a multiple of four) after a stream that starts with the .xz magic, and go on to decode the stream that follows; a damaged stream after the padding raises like any other damaged later stream. The skipping is done in the shared Python stream loop and turned on only by lzma, rather than with LZMA_CONCATENATED in C, because that would need a new finish method on LZMADecompressor and would reject the mixed .xz/.lzma data that FORMAT_AUTO decodes today. A run of null bytes whose size is not a multiple of four is still handed to the decompressor as before, so nothing that decodes today starts to fail on that account, although the format specification says it is an error. FORMAT_ALONE, FORMAT_RAW, bz2 and compression.zstd are unchanged.

Fixes #88300

…ZMAFile

Null bytes in multiples of four after an .xz stream are now skipped, so
that a stream following them is decoded instead of ignored.
@gpshead gpshead added needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes labels Nov 1, 2026
@gpshead gpshead self-assigned this Nov 1, 2026
@gpshead gpshead removed their assignment Nov 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

lzma: stream padding in xz files

1 participant