python · py7zrHeads-up
py7zr: PackInfo._read() O(n^2) cumulative sum in archiveinfo.py
PackInfo._read() in archiveinfo.py uses an O(n^2) cumulative sum pattern where numstreams is read directly from the archive header, causing excessive CPU consum
What changed
PackInfo._read() in archiveinfo.py uses an O(n^2) cumulative sum pattern where numstreams is read directly from the archive header, causing excessive CPU consumption during SevenZipFile.__init__().
Who it affects
Any application that opens .7z archives from untrusted sources using py7zr.SevenZipFile().
What to do today
Replace the O(n^2) cumulative sum with an O(n) cumulative sum using itertools.accumulate.
The trail
Collected→
Audited→
Written→
Published
Source
GitHub Advisory · py7zr