[3.14] gh-161096: Reject invalid TZif abbreviation block sizes in zoneinfo (GH-161097) (#161123)

ZoneInfo.from_file() now raises ValueError for a negative charcnt or one
above 512, and reads the abbreviation index as unsigned.

ANT-2026-W7U7UDLT

(cherry picked from commit e9f37a3)

Author: gpshead

Lib/test/test_zoneinfo/test_zoneinfo.py

@@ -795,6 +795,34 @@ def test_invalid_transition_index(self):
         with self.assertRaises(ValueError):
             self.klass.from_file(f)
 
+    def test_invalid_charcnt(self):
+        # 128 local time types whose abbreviations are the suffixes of a
+        # single long abbreviation spanning the entire block: every index
+        # would get its own copy of most of the block.
+        types = b"".join(struct.pack(">lbb", 3600, 0, i) for i in range(128))
+        chars = b"A" * 65535 + b"\x00"
+
+        # With a negative charcnt the block would be the rest of the file
+        for charcnt in (len(chars), -1):
+            with self.subTest(charcnt=charcnt):
+                header = b"TZif" + b"\x00" * 16
+                header += struct.pack(">6l", 0, 0, 0, 0, 128, charcnt)
+                f = io.BytesIO(header + types + chars)
+
+                with self.assertRaises(ValueError):
+                    self.klass.from_file(f)
+
+    def test_abbreviation_index_above_127(self):
+        chars = b"X" * 129 + b"\x00" + b"ABC\x00"
+        header = b"TZif" + b"\x00" * 16
+        header += struct.pack(">6l", 0, 0, 0, 0, 1, len(chars))
+        types = struct.pack(">lbB", 3600, 0, 130)
+        zi = self.klass.from_file(io.BytesIO(header + types + chars))
+
+        dt = datetime(2026, 1, 1, tzinfo=zi)
+        self.assertEqual(dt.tzname(), "ABC")
+        self.assertEqual(dt.utcoffset(), ONE_H)
+
     def test_transition_lookahead_out_of_bounds(self):
         STD = ZoneOffset("STD", ZERO)
         DST = ZoneOffset("DST", ONE_H, ONE_H)

Lib/zoneinfo/_common.py

@@ -78,7 +78,7 @@ def load_data(fobj):
     # Read the ttinfo struct, (utoff, isdst, abbrind)
     if typecnt:
         utcoff, isdst, abbrind = zip(
-            *(struct.unpack(">lbb", fobj.read(6)) for i in range(typecnt))
+            *(struct.unpack(">lbB", fobj.read(6)) for i in range(typecnt))
         )
     else:
         utcoff = ()
@@ -89,6 +89,14 @@ def load_data(fobj):
     # not by position in the array but by position in the unsplit
     # abbreviation string. I suppose this makes more sense in C, which uses
     # null to terminate the strings, but it's inconvenient here...
+    #
+    # Each abbreviation index is a single unsigned byte, so only about the
+    # first 256 characters of the block can be referenced.  A much longer
+    # block holds nothing usable, and reading it would copy most of the
+    # block for every local time type.
+    if not 0 <= charcnt <= 512:
+        raise ValueError(f"Invalid TZif file: invalid charcnt: {charcnt}")
+
     abbr_vals = {}
     abbr_chars = fobj.read(charcnt)
 

Misc/NEWS.d/next/Library/2026-10-22-05-20-52.gh-issue-161096.vkhfyy.rst

@@ -0,0 +1,4 @@
+Fix :meth:`zoneinfo.ZoneInfo.from_file` accepting TZif data with a negative or
+oversized abbreviation block, which could use hundreds of times the file size
+in memory; it now raises :exc:`ValueError`. Abbreviation indexes above 127 now
+also give the correct time zone abbreviation.