From fe5796ad6fa8684aa2de4fb886faaa8b4f689b16 Mon Sep 17 00:00:00 2001
From: Łukasz Burchard <lburchard@google.com>
Date: Tue, 16 Jun 2026 07:25:27 -0700
Subject: [PATCH] [variations] Enforce uncompressed size limit on seeds

This change mitigates a potential Out-Of-Memory (OOM) crash
vulnerability when decompressing GZIP-compressed variations seeds.
Currently, variations seed decompression trustfully reads the ISIZE
footer of the gzip stream to resize the allocation buffer before
decompressing. A malicious or compromised network actor intercepting
variations requests could serve a gzip bomb with a forged ISIZE footer
(e.g., 4GB) to trigger a deterministic OOM crash.

This CL enforces a maximum uncompressed variations seed size limit of 50
MiB. Seeds whose uncompressed size (as reported by the gzip footer)
exceeds this limit are rejected safely before decompression is
attempted.

TAG=agy
CONV=dcf7b49a-43d1-420d-a3b0-bc59b4b449bc

Bug: 513323066
Change-Id: Ic165be6d1bf76ef8b26b6da21a8669bcf99b74f3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7907587
Reviewed-by: Alexei Svitkine <asvitkine@chromium.org>
Commit-Queue: Łukasz Burchard <lburchard@google.com>
Reviewed-by: Ramon Cano Aparicio <rcanoaparicio@google.com>
Cr-Commit-Position: refs/heads/main@{#1647532}
---

diff --git a/components/variations/metrics.h b/components/variations/metrics.h
index 5d312c1e8..d307f965 100644
--- a/components/variations/metrics.h
+++ b/components/variations/metrics.h
@@ -53,6 +53,7 @@
 //
 // These values are persisted to logs. Entries should not be renumbered and
 // numeric values should never be reused.
+// LINT.IfChange(StoreSeedResult)
 enum class StoreSeedResult {
   kSuccess = 0,
   // kFailedEmpty = 1,  // Deprecated.
@@ -74,8 +75,11 @@
   kNonGzipDeltaCount = 13,
   kGzipFullCount = 14,
   kNonGzipFullCount = 15,
-  kMaxValue = kNonGzipFullCount,
+  // The uncompressed size of the seed exceeded the limit.
+  kUncompressedSizeLimitExceeded = 16,
+  kMaxValue = kUncompressedSizeLimitExceeded,
 };
+// LINT.ThenChange(//tools/metrics/histograms/metadata/variations/enums.xml:VariationsSeedStoreResult)
 
 // The result of updating the date associated with an existing stored variations
 // seed.
diff --git a/components/variations/variations_seed_store.cc b/components/variations/variations_seed_store.cc
index c91da89..bb15365 100644
--- a/components/variations/variations_seed_store.cc
+++ b/components/variations/variations_seed_store.cc
@@ -10,7 +10,9 @@
 
 #include "base/base64.h"
 #include "base/build_time.h"
+#include "base/byte_size.h"
 #include "base/command_line.h"
+#include "base/debug/dump_without_crashing.h"
 #include "base/functional/callback_helpers.h"
 #include "base/logging.h"
 #include "base/metrics/histogram_functions.h"
@@ -149,6 +151,23 @@
 // Returns success or error, populating result on success.
 StoreSeedResult Uncompress(const std::string& compressed, std::string* result) {
   DCHECK(result);
+  uint32_t uncompressed_size = compression::GetUncompressedSize(compressed);
+
+  // Dump without crashing to alert us that actual seeds are approaching the
+  // rejection threshold below.
+  constexpr static base::ByteSize kDumpThreshold = base::MiBU(40);
+  if (uncompressed_size > kDumpThreshold.InBytes()) {
+    base::debug::DumpWithoutCrashing();
+  }
+
+  // Enforce a maximum uncompressed size to prevent OOM / Gzip bomb crashes.
+  // We use 50 MiB as a conservative limit, similar to seed_reader_writer.cc.
+  constexpr static base::ByteSize kMaxUncompressedSeedSize = base::MiBU(50);
+  if (uncompressed_size > kMaxUncompressedSeedSize.InBytes()) {
+    VLOG(1) << "Rejecting seed: uncompressed size " << uncompressed_size
+            << " exceeds limit of " << kMaxUncompressedSeedSize.InBytes();
+    return StoreSeedResult::kUncompressedSizeLimitExceeded;
+  }
   if (!compression::GzipUncompress(compressed, result)) {
     return StoreSeedResult::kFailedUngzip;
   }
diff --git a/components/variations/variations_seed_store_unittest.cc b/components/variations/variations_seed_store_unittest.cc
index b73ddaa..63d7bde7 100644
--- a/components/variations/variations_seed_store_unittest.cc
+++ b/components/variations/variations_seed_store_unittest.cc
@@ -1614,6 +1614,34 @@
   EXPECT_EQ(serialized_seed, SerializeSeed(stored_seed_));
 }
 
+TEST_P(StoreSeedDataAllGroupsTest, GzipUncompressSizeLimit) {
+  TestVariationsSeedStore seed_store(&prefs_, temp_dir_.GetPath());
+  ASSERT_EQ(base::FieldTrialList::FindFullName(kSeedFileTrial),
+            GetParam().field_trial_group);
+
+  std::string compressed;
+  ASSERT_TRUE(compression::GzipCompress(CreateTooLargeData(), &compressed));
+
+  base::HistogramTester histogram_tester;
+
+  // Storing should fail because the uncompressed size exceeds the 50 MiB limit.
+  EXPECT_FALSE(
+      StoreSeedData(seed_store, compressed, {.is_gzip_compressed = true}));
+
+  histogram_tester.ExpectBucketCount("Variations.SeedStoreResult",
+                                     StoreSeedResult::kGzipFullCount, 1);
+  histogram_tester.ExpectBucketCount(
+      "Variations.SeedStoreResult",
+      StoreSeedResult::kUncompressedSizeLimitExceeded, 1);
+  histogram_tester.ExpectTotalCount("Variations.SeedStoreResult", 2);
+
+  // Check that trying to store a too-large seed leaves the local state
+  // unchanged and does not write to the seed file.
+  CheckRegularSeedAndSeedPrefsAreCleared(prefs_, seed_store);
+  EXPECT_FALSE(timer_.IsRunning());
+  EXPECT_FALSE(base::PathExists(temp_seed_file_path_));
+}
+
 TEST_P(StoreSeedDataAllGroupsTest, CountryCode) {
   TestVariationsSeedStore seed_store(&prefs_, temp_dir_.GetPath());
   ASSERT_EQ(base::FieldTrialList::FindFullName(kSeedFileTrial),
diff --git a/tools/metrics/histograms/metadata/variations/enums.xml b/tools/metrics/histograms/metadata/variations/enums.xml
index 10ea51c..f0113b7 100644
--- a/tools/metrics/histograms/metadata/variations/enums.xml
+++ b/tools/metrics/histograms/metadata/variations/enums.xml
@@ -293,6 +293,8 @@
 
 <!-- LINT.ThenChange(//components/variations/metrics.h:LoadSeedResult) -->
 
+<!-- LINT.IfChange(VariationsSeedStoreResult) -->
+
 <enum name="VariationsSeedStoreResult">
   <int value="0" label="Success"/>
   <int value="1" label="Failed - Empty Seed (obsolete)"/>
@@ -310,8 +312,11 @@
   <int value="13" label="Non-Gzip Delta Count"/>
   <int value="14" label="Gzip Full Count"/>
   <int value="15" label="Non-Gzip Full Count"/>
+  <int value="16" label="Failed - Uncompressed Size Limit Exceeded"/>
 </enum>
 
+<!-- LINT.ThenChange(//components/variations/metrics.h:StoreSeedResult) -->
+
 <enum name="VariationsSeedUsage">
   <int value="0" label="Regular seed used"/>
   <int value="1" label="Expired regular seed">No seed used</int>

diff --git a/components/variations/variations_seed_store_unittest.cc b/components/variations/variations_seed_store_unittest.cc
index b73ddaa..63d7bde7 100644
--- a/components/variations/variations_seed_store_unittest.cc
+++ b/components/variations/variations_seed_store_unittest.cc
@@ -1614,6 +1614,34 @@
   EXPECT_EQ(serialized_seed, SerializeSeed(stored_seed_));
 }
 
+TEST_P(StoreSeedDataAllGroupsTest, GzipUncompressSizeLimit) {
+  TestVariationsSeedStore seed_store(&prefs_, temp_dir_.GetPath());
+  ASSERT_EQ(base::FieldTrialList::FindFullName(kSeedFileTrial),
+            GetParam().field_trial_group);
+
+  std::string compressed;
+  ASSERT_TRUE(compression::GzipCompress(CreateTooLargeData(), &compressed));
+
+  base::HistogramTester histogram_tester;
+
+  // Storing should fail because the uncompressed size exceeds the 50 MiB limit.
+  EXPECT_FALSE(
+      StoreSeedData(seed_store, compressed, {.is_gzip_compressed = true}));
+
+  histogram_tester.ExpectBucketCount("Variations.SeedStoreResult",
+                                     StoreSeedResult::kGzipFullCount, 1);
+  histogram_tester.ExpectBucketCount(
+      "Variations.SeedStoreResult",
+      StoreSeedResult::kUncompressedSizeLimitExceeded, 1);
+  histogram_tester.ExpectTotalCount("Variations.SeedStoreResult", 2);
+
+  // Check that trying to store a too-large seed leaves the local state
+  // unchanged and does not write to the seed file.
+  CheckRegularSeedAndSeedPrefsAreCleared(prefs_, seed_store);
+  EXPECT_FALSE(timer_.IsRunning());
+  EXPECT_FALSE(base::PathExists(temp_seed_file_path_));
+}
+
 TEST_P(StoreSeedDataAllGroupsTest, CountryCode) {
   TestVariationsSeedStore seed_store(&prefs_, temp_dir_.GetPath());
   ASSERT_EQ(base::FieldTrialList::FindFullName(kSeedFileTrial),