(RHEL-239858) journal: limit decompress_blob() output to DATA_SIZE_MAX

[siteshwar]

We already have checks in place during compression that limit the data we compress, so they shouldn't decompress to anything larger than DATA_SIZE_MAX unless they've been tampered with. Let's make this explicit and limit all our decompress_blob() calls in journal-handling code to that limit.

One possible scenario this should prevent is when one tries to open and verify a journal file that contains a compression bomb in its payload:

$ ls -lh test.journal
-rw-rw-r--+ 1 fsumsal fsumsal 1.2M Apr 12 15:07 test.journal

$ systemd-run --user --wait --pipe -- build-local/journalctl --verify --file=$PWD/test.journal Running as unit: run-p682422-i4875779.service
000110: Invalid hash (00000000 vs. 11e4948d73bdafdd) 000110: Invalid object contents: Bad message
File corruption detected at /home/fsumsal/repos/@systemd/systemd/test.journal:272 (of 1249896 bytes, 0%). FAIL: /home/fsumsal/repos/@systemd/systemd/test.journal (Bad message)
Finished with result: exit-code
Main processes terminated with: code=exited, status=1/FAILURE
Service runtime: 48.051s
CPU time consumed: 47.941s
Memory peak: 8G (swap: 0B)

Same could be, in theory, possible with just journalctl --file=, but the reproducer would be a bit more complicated (haven't tried it, yet).

Lastly, the change in journal-remote is mostly hardening, as the maximum input size to decompress_blob() there is mandated by MHD's connection memory limit (set to JOURNAL_SERVER_MEMORY_MAX which is 128 KiB at the time of writing), so the possible output size there is already quite limited (e.g. ~800 - 900 MiB for xz-compressed data).

(cherry picked from commit 31d360fb0b28859aba891aaefb1452f820a5861a)

Resolves: RHEL-239858

[github-actions]

Commit validation

Tracker - RHEL-239858

The following commits meet all requirements

commit	upstream
848be2e - journal: limit decompress_blob() output to DATA_SIZE_MAX	systemd/systemd@31d360f

---

Tracker validation

Success

🟢 Tracker RHEL-239858 has set desired product: rhel-10.4
🟢 Tracker RHEL-239858 has set desired component: systemd
🟢 Tracker RHEL-239858 has been approved
🟢 Tracker RHEL-239858 has set severity

---

Pull Request validation

Failed

🔴 Failed or pending checks:

• rpm-build:centos-stream-10-ppc64le[failure]
• rpm-build:centos-stream-10-s390x[failure]
• rpm-build:centos-stream-10-aarch64[failure]
• rpm-build:centos-stream-10-x86_64[failure]
• CodeQL[neutral]
• PR (address)[failure]
• PR (undefined)[failure]
• PR (memory)[failure]
• build (clang, 18, lld, auto)[failure]
• ci (centos, 10, address,undefined, 1, -Og, yes, 0, sanitizers)[failure]
• build (gcc, 13, mold, openssl)[failure]
• ci (centos, 10, 0, -Og, yes, 0, TEST-21-DFUZZER, regular-nspawn)[failure]
• build (clang, 16, bfd, openssl)[failure]
• build (clang, 14, mold, gcrypt)[failure]
• build (GCC, openssl)[failure]
• build (CLANG, gcrypt)[failure]
• Analyze (cpp)[failure]
• ci (centos, 10, 0, -Og, yes, 1, TEST-21-DFUZZER TEST-60-MOUNT-RATELIMIT, regular-vm)[failure]
• build (CLANG_ASAN_UBSAN, auto)[failure]
• build (CLANG_RELEASE, auto)[failure]
• build (gcc, 11, bfd, gcrypt)[failure]
• build (GCC, auto)[failure]
• build (CLANG_ASAN_UBSAN_NO_DEPS, auto)[failure]
• build (CLANG, auto)[failure]
• build (GCC_ASAN_UBSAN, auto)[failure]

🔴 Review - Missing review from a member (1 required)

---

Triggered by Workflow Run

[siteshwar]

On further investigation, it was found that its not a bug in RHEL 10. I am going to close this pull request.