Bug report

Bug description:

ZoneInfo.from_file() takes the TZif header's charcnt on trust: a negative value makes the abbreviation block the rest of the file, and since each distinct abbreviation index gets its own copy of the bytes up to the next NUL, one long block referenced by 128 local time types leaves the ZoneInfo holding about 512 times the file size. abbrind is also unpacked as a signed byte, so indexes 128 to 255 count from the end of the block and give the wrong abbreviation.

import io, struct
from zoneinfo import ZoneInfo

block = b"A" * (2**20 - 5) + "\U0001F552".encode() + b"\0"
types = b"".join(struct.pack(">lbb", 3600, 0, i) for i in range(128))
head = b"TZif" + bytes(16) + struct.pack(">6l", 0, 0, 0, 0, 128, len(block))
zone = ZoneInfo.from_file(io.BytesIO(head + types + block))  # ~537 MB held for a 1 MiB file

Expected ValueError, as for other malformed TZif data; tzcode's zic caps the block at 50 bytes and no installed zone file comes close. Related: gh-143241 and gh-145883.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-161096: Reject invalid TZif abbreviation block sizes in zoneinfo #161097
• [3.15] gh-161096: Reject invalid TZif abbreviation block sizes in zoneinfo (GH-161097) #161122
• [3.14] gh-161096: Reject invalid TZif abbreviation block sizes in zoneinfo (GH-161097) #161123