From c6ac508a50007a68c770db5ca4414fd351f91159 Mon Sep 17 00:00:00 2001
From: Andrew Gunnerson <accounts+github@chiller3.com>
Date: Tue, 29 Aug 2023 18:11:44 -0400
Subject: [PATCH] Work around upstream bzip2 infinite loop issue

There's an upstream bug that causes an infinite loop in the
`write::BzDecoder` destructor if the decoder is fed invalid data. While
this never happens during normal operation, it is possible to run into
this by running `ota extract` against a `--stripped` OTA file.

Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
---
 Cargo.lock |  6 ++----
 Cargo.toml | 10 +++++++++-
 deny.toml  |  1 +
 3 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index dcb41bc..ce4b3f8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -224,8 +224,7 @@ checksum = "89b2fd2a0dcf38d7971e2194b6b6eebab45ae01067456a7fd93d5547a61b70be"
 [[package]]
 name = "bzip2"
 version = "0.4.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdb116a6ef3f6c3698828873ad02c3014b3c85cadb88496095628e3ef1e347f8"
+source = "git+https://github.com/jongiddy/bzip2-rs?rev=2aefcb4d3634de1df226c73d93f758d65228bb8c#2aefcb4d3634de1df226c73d93f758d65228bb8c"
 dependencies = [
  "bzip2-sys",
  "libc",
@@ -234,8 +233,7 @@ dependencies = [
 [[package]]
 name = "bzip2-sys"
 version = "0.1.11+1.0.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "736a955f3fa7875102d57c82b8cac37ec45224a07fd32d58f9f7a186b6cd4cdc"
+source = "git+https://github.com/jongiddy/bzip2-rs?rev=2aefcb4d3634de1df226c73d93f758d65228bb8c#2aefcb4d3634de1df226c73d93f758d65228bb8c"
 dependencies = [
  "cc",
  "libc",
diff --git a/Cargo.toml b/Cargo.toml
index c8d0db8..f50bd29 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -10,7 +10,6 @@ edition = "2021"
 anyhow = "1.0.75"
 base64 = "0.21.3"
 byteorder = "1.4.3"
-bzip2 = "0.4.4"
 clap = { version = "4.4.1", features = ["derive"] }
 clap_complete = "4.4.0"
 cms = { version = "0.2.2", features = ["std"] }
@@ -45,6 +44,15 @@ topological-sort = "0.2.2"
 x509-cert = { version = "0.2.4", features = ["builder"] }
 xz2 = "0.1.7"
 
+# There's an upstream bug that causes an infinite loop in the write::BzDecoder
+# destructor if the decoder is fed invalid data. While this never happens during
+# normal operation, it is possible to run into this by running `ota extract`
+# against a `--stripped` OTA file.
+# https://github.com/alexcrichton/bzip2-rs/pull/99
+[dependencies.bzip2]
+git = "https://github.com/jongiddy/bzip2-rs"
+rev = "2aefcb4d3634de1df226c73d93f758d65228bb8c"
+
 # https://github.com/zip-rs/zip/pull/383
 [dependencies.zip]
 git = "https://github.com/chenxiaolong/zip"
diff --git a/deny.toml b/deny.toml
index fb4e11e..3d1fd07 100644
--- a/deny.toml
+++ b/deny.toml
@@ -36,4 +36,5 @@ unknown-registry = "deny"
 unknown-git = "deny"
 allow-git = [
     "https://github.com/chenxiaolong/zip",
+    "https://github.com/jongiddy/bzip2-rs",
 ]