Issue #14398: Fix size truncation and overflow bugs in bz2 module.

Lib/test/test_bz2.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python
 from test import test_support
-from test.test_support import TESTFN, import_module
+from test.test_support import TESTFN, _4G, bigmemtest, import_module, findfile
 
 import unittest
 from cStringIO import StringIO
@@ -24,6 +24,9 @@ class BaseTest(unittest.TestCase):
     DATA = 'BZh91AY&SY.\xc8N\x18\x00\x01>_\x80\x00\x10@\x02\xff\xf0\x01\x07n\x00?\xe7\xff\xe00\x01\x99\xaa\x00\xc0\x03F\x86\x8c#&\x83F\x9a\x03\x06\xa6\xd0\xa6\x93M\x0fQ\xa7\xa8\x06\x804hh\x12$\x11\xa4i4\xf14S\xd2<Q\xb5\x0fH\xd3\xd4\xdd\xd5\x87\xbb\xf8\x94\r\x8f\xafI\x12\xe1\xc9\xf8/E\x00pu\x89\x12]\xc9\xbbDL\nQ\x0e\t1\x12\xdf\xa0\xc0\x97\xac2O9\x89\x13\x94\x0e\x1c7\x0ed\x95I\x0c\xaaJ\xa4\x18L\x10\x05#\x9c\xaf\xba\xbc/\x97\x8a#C\xc8\xe1\x8cW\xf9\xe2\xd0\xd6M\xa7\x8bXa<e\x84t\xcbL\xb3\xa7\xd9\xcd\xd1\xcb\x84.\xaf\xb3\xab\xab\xad`n}\xa0lh\tE,\x8eZ\x15\x17VH>\x88\xe5\xcd9gd6\x0b\n\xe9\x9b\xd5\x8a\x99\xf7\x08.K\x8ev\xfb\xf7xw\xbb\xdf\xa1\x92\xf1\xdd|/";\xa2\xba\x9f\xd5\xb1#A\xb6\xf6\xb3o\xc9\xc5y\\\xebO\xe7\x85\x9a\xbc\xb6f8\x952\xd5\xd7"%\x89>V,\xf7\xa6z\xe2\x9f\xa3\xdf\x11\x11"\xd6E)I\xa9\x13^\xca\xf3r\xd0\x03U\x922\xf26\xec\xb6\xed\x8b\xc3U\x13\x9d\xc5\x170\xa4\xfa^\x92\xacDF\x8a\x97\xd6\x19\xfe\xdd\xb8\xbd\x1a\x9a\x19\xa3\x80ankR\x8b\xe5\xd83]\xa9\xc6\x08\x82f\xf6\xb9"6l$\xb8j@\xc0\x8a\xb0l1..\xbak\x83ls\x15\xbc\xf4\xc1\x13\xbe\xf8E\xb8\x9d\r\xa8\x9dk\x84\xd3n\xfa\xacQ\x07\xb1%y\xaav\xb4\x08\xe0z\x1b\x16\xf5\x04\xe9\xcc\xb9\x08z\x1en7.G\xfc]\xc9\x14\xe1B@\xbb!8`'
     DATA_CRLF = 'BZh91AY&SY\xaez\xbbN\x00\x01H\xdf\x80\x00\x12@\x02\xff\xf0\x01\x07n\x00?\xe7\xff\xe0@\x01\xbc\xc6`\x86*\x8d=M\xa9\x9a\x86\xd0L@\x0fI\xa6!\xa1\x13\xc8\x88jdi\x8d@\x03@\x1a\x1a\x0c\x0c\x83 \x00\xc4h2\x19\x01\x82D\x84e\t\xe8\x99\x89\x19\x1ah\x00\r\x1a\x11\xaf\x9b\x0fG\xf5(\x1b\x1f?\t\x12\xcf\xb5\xfc\x95E\x00ps\x89\x12^\xa4\xdd\xa2&\x05(\x87\x04\x98\x89u\xe40%\xb6\x19\'\x8c\xc4\x89\xca\x07\x0e\x1b!\x91UIFU%C\x994!DI\xd2\xfa\xf0\xf1N8W\xde\x13A\xf5\x9cr%?\x9f3;I45A\xd1\x8bT\xb1<l\xba\xcb_\xc00xY\x17r\x17\x88\x08\x08@\xa0\ry@\x10\x04$)`\xf2\xce\x89z\xb0s\xec\x9b.iW\x9d\x81\xb5-+t\x9f\x1a\'\x97dB\xf5x\xb5\xbe.[.\xd7\x0e\x81\xe7\x08\x1cN`\x88\x10\xca\x87\xc3!"\x80\x92R\xa1/\xd1\xc0\xe6mf\xac\xbd\x99\xcca\xb3\x8780>\xa4\xc7\x8d\x1a\\"\xad\xa1\xabyBg\x15\xb9l\x88\x88\x91k"\x94\xa4\xd4\x89\xae*\xa6\x0b\x10\x0c\xd6\xd4m\xe86\xec\xb5j\x8a\x86j\';\xca.\x01I\xf2\xaaJ\xe8\x88\x8cU+t3\xfb\x0c\n\xa33\x13r2\r\x16\xe0\xb3(\xbf\x1d\x83r\xe7M\xf0D\x1365\xd8\x88\xd3\xa4\x92\xcb2\x06\x04\\\xc1\xb0\xea//\xbek&\xd8\xe6+t\xe5\xa1\x13\xada\x16\xder5"w]\xa2i\xb7[\x97R \xe2IT\xcd;Z\x04dk4\xad\x8a\t\xd3\x81z\x10\xf1:^`\xab\x1f\xc5\xdc\x91N\x14$+\x9e\xae\xd3\x80'
 
+    with open(findfile("testbz2_bigmem.bz2"), "rb") as f:
+        DATA_BIGMEM = f.read()
+
     if has_cmdline_bunzip2:
         def decompress(self, data):
             pop = subprocess.Popen("bunzip2", shell=True,
@@ -43,6 +46,7 @@ def decompress(self, data):
         def decompress(self, data):
             return bz2.decompress(data)
 
+
 class BZ2FileTest(BaseTest):
     "Test BZ2File type miscellaneous methods."
 
@@ -346,6 +350,17 @@ def testCompressChunks10(self):
         data += bz2c.flush()
         self.assertEqual(self.decompress(data), self.TEXT)
 
+    @bigmemtest(_4G, memuse=1.25)
+    def testBigmem(self, size):
+        text = "a" * size
+        bz2c = bz2.BZ2Compressor()
+        data = bz2c.compress(text) + bz2c.flush()
+        del text
+        text = self.decompress(data)
+        self.assertEqual(len(text), size)
+        self.assertEqual(text.strip("a"), "")
+
+
 class BZ2DecompressorTest(BaseTest):
     def test_Constructor(self):
         self.assertRaises(TypeError, BZ2Decompressor, 42)
@@ -384,6 +399,15 @@ def testEOFError(self):
         text = bz2d.decompress(self.DATA)
         self.assertRaises(EOFError, bz2d.decompress, "anything")
 
+    @bigmemtest(_4G, memuse=1.25)
+    def testBigmem(self, size):
+        # Issue #14398: decompression fails when output data is >=2GB.
+        if size < _4G:
+            self.skipTest("Test needs 5GB of memory to run.")
+        text = bz2.BZ2Decompressor().decompress(self.DATA_BIGMEM)
+        self.assertEqual(len(text), _4G)
+        self.assertEqual(text.strip("\0"), "")
+
 
 class FuncTest(BaseTest):
     "Test module functions"
@@ -407,6 +431,24 @@ def testDecompressIncomplete(self):
         # "Test decompress() function with incomplete data"
         self.assertRaises(ValueError, bz2.decompress, self.DATA[:-10])
 
+    @bigmemtest(_4G, memuse=1.25)
+    def testCompressBigmem(self, size):
+        text = "a" * size
+        data = bz2.compress(text)
+        del text
+        text = self.decompress(data)
+        self.assertEqual(len(text), size)
+        self.assertEqual(text.strip("a"), "")
+
+    @bigmemtest(_4G, memuse=1.25)
+    def testDecompressBigmem(self, size):
+        # Issue #14398: decompression fails when output data is >=2GB.
+        if size < _4G:
+            self.skipTest("Test needs 5GB of memory to run.")
+        text = bz2.decompress(self.DATA_BIGMEM)
+        self.assertEqual(len(text), _4G)
+        self.assertEqual(text.strip("\0"), "")
+
 def test_main():
     test_support.run_unittest(
         BZ2FileTest,

Misc/NEWS

@@ -122,6 +122,8 @@ Core and Builtins
 Library
 -------
 
+- Issue #14398: Fix size truncation and overflow bugs in the bz2 module.
+
 - Issue #5148: Ignore 'U' in mode given to gzip.open() and gzip.GzipFile().
 
 - Issue #16220: wsgiref now always calls close() on an iterable response.

Modules/bz2module.c

@@ -41,23 +41,8 @@ typedef fpos_t Py_off_t;
 #define MODE_READ_EOF 2
 #define MODE_WRITE    3
 
-#define BZ2FileObject_Check(v)  (Py_TYPE(v) == &BZ2File_Type)
 
-
+#ifndef BZ_CONFIG_ERROR
-#ifdef BZ_CONFIG_ERROR
-
-#if SIZEOF_LONG >= 8
-#define BZS_TOTAL_OUT(bzs) \
-    (((long)bzs->total_out_hi32 << 32) + bzs->total_out_lo32)
-#elif SIZEOF_LONG_LONG >= 8
-#define BZS_TOTAL_OUT(bzs) \
-    (((PY_LONG_LONG)bzs->total_out_hi32 << 32) + bzs->total_out_lo32)
-#else
-#define BZS_TOTAL_OUT(bzs) \
-    bzs->total_out_lo32
-#endif
-
-#else /* ! BZ_CONFIG_ERROR */
 
 #define BZ2_bzRead bzRead
 #define BZ2_bzReadOpen bzReadOpen
@@ -72,8 +57,6 @@ typedef fpos_t Py_off_t;
 #define BZ2_bzDecompressInit bzDecompressInit
 #define BZ2_bzDecompressEnd bzDecompressEnd
 
-#define BZS_TOTAL_OUT(bzs) bzs->total_out
-
 #endif /* ! BZ_CONFIG_ERROR */
 
 
@@ -90,6 +73,8 @@ typedef fpos_t Py_off_t;
 #define RELEASE_LOCK(obj)
 #endif
 
+#define MIN(X, Y) (((X) < (Y)) ? (X) : (Y))
+
 /* Bits in f_newlinetypes */
 #define NEWLINE_UNKNOWN 0       /* No newline seen, yet */
 #define NEWLINE_CR 1            /* \r newline seen */
@@ -234,6 +219,20 @@ Util_NewBufferSize(size_t currentsize)
     return currentsize + (currentsize >> 3) + 6;
 }
 
+static int
+Util_GrowBuffer(PyObject **buf)
+{
+    size_t size = PyString_GET_SIZE(*buf);
+    size_t new_size = Util_NewBufferSize(size);
+    if (new_size > size) {
+        return _PyString_Resize(buf, new_size);
+    } else {  /* overflow */
+        PyErr_SetString(PyExc_OverflowError,
+                        "Unable to allocate buffer - output too large");
+        return -1;
+    }
+}
+
 /* This is a hacked version of Python's fileobject.c:get_line(). */
 static PyObject *
 Util_GetLine(BZ2FileObject *f, int n)
@@ -1608,20 +1607,16 @@ static PyObject *
 BZ2Comp_compress(BZ2CompObject *self, PyObject *args)
 {
     Py_buffer pdata;
-    char *data;
+    size_t input_left;
-    int datasize;
+    size_t output_size = 0;
-    int bufsize = SMALLCHUNK;
-    PY_LONG_LONG totalout;
     PyObject *ret = NULL;
     bz_stream *bzs = &self->bzs;
     int bzerror;
 
     if (!PyArg_ParseTuple(args, "s*:compress", &pdata))
         return NULL;
-    data = pdata.buf;
-    datasize = pdata.len;
 
-    if (datasize == 0) {
+    if (pdata.len == 0) {
         PyBuffer_Release(&pdata);
         return PyString_FromString("");
     }
@@ -1633,40 +1628,52 @@ BZ2Comp_compress(BZ2CompObject *self, PyObject *args)
         goto error;
     }
 
-    ret = PyString_FromStringAndSize(NULL, bufsize);
+    ret = PyString_FromStringAndSize(NULL, SMALLCHUNK);
     if (!ret)
         goto error;
 
-    bzs->next_in = data;
+    bzs->next_in = pdata.buf;
-    bzs->avail_in = datasize;
+    bzs->avail_in = MIN(pdata.len, UINT_MAX);
-    bzs->next_out = BUF(ret);
+    input_left = pdata.len - bzs->avail_in;
-    bzs->avail_out = bufsize;
 
-    totalout = BZS_TOTAL_OUT(bzs);
+    bzs->next_out = BUF(ret);
+    bzs->avail_out = PyString_GET_SIZE(ret);
 
     for (;;) {
+        char *saved_next_out;
+
         Py_BEGIN_ALLOW_THREADS
+        saved_next_out = bzs->next_out;
         bzerror = BZ2_bzCompress(bzs, BZ_RUN);
+        output_size += bzs->next_out - saved_next_out;
         Py_END_ALLOW_THREADS
+
         if (bzerror != BZ_RUN_OK) {
             Util_CatchBZ2Error(bzerror);
             goto error;
         }
-        if (bzs->avail_in == 0)
+        if (bzs->avail_in == 0) {
-            break; /* no more input data */
+            if (input_left == 0)
+                break; /* no more input data */
+            bzs->avail_in = MIN(input_left, UINT_MAX);
+            input_left -= bzs->avail_in;
+        }
         if (bzs->avail_out == 0) {
-            bufsize = Util_NewBufferSize(bufsize);
+            size_t buffer_left = PyString_GET_SIZE(ret) - output_size;
-            if (_PyString_Resize(&ret, bufsize) < 0) {
+            if (buffer_left == 0) {
-                BZ2_bzCompressEnd(bzs);
+                if (Util_GrowBuffer(&ret) < 0) {
-                goto error;
+                    BZ2_bzCompressEnd(bzs);
+                    goto error;
+                }
+                bzs->next_out = BUF(ret) + output_size;
+                buffer_left = PyString_GET_SIZE(ret) - output_size;
             }
-            bzs->next_out = BUF(ret) + (BZS_TOTAL_OUT(bzs)
+            bzs->avail_out = MIN(buffer_left, UINT_MAX);
-                                        - totalout);
-            bzs->avail_out = bufsize - (bzs->next_out - BUF(ret));
         }
     }
 
-    _PyString_Resize(&ret, (Py_ssize_t)(BZS_TOTAL_OUT(bzs) - totalout));
+    if (_PyString_Resize(&ret, output_size) < 0)
+        goto error;
 
     RELEASE_LOCK(self);
     PyBuffer_Release(&pdata);
@@ -1689,33 +1696,34 @@ You must not use the compressor object after calling this method.\n\
 static PyObject *
 BZ2Comp_flush(BZ2CompObject *self)
 {
-    int bufsize = SMALLCHUNK;
+    size_t output_size = 0;
     PyObject *ret = NULL;
     bz_stream *bzs = &self->bzs;
-    PY_LONG_LONG totalout;
     int bzerror;
 
     ACQUIRE_LOCK(self);
     if (!self->running) {
-        PyErr_SetString(PyExc_ValueError, "object was already "
+        PyErr_SetString(PyExc_ValueError, "object was already flushed");
-                                          "flushed");
         goto error;
     }
     self->running = 0;
 
-    ret = PyString_FromStringAndSize(NULL, bufsize);
+    ret = PyString_FromStringAndSize(NULL, SMALLCHUNK);
     if (!ret)
         goto error;
 
     bzs->next_out = BUF(ret);
-    bzs->avail_out = bufsize;
+    bzs->avail_out = PyString_GET_SIZE(ret);
-
-    totalout = BZS_TOTAL_OUT(bzs);
 
     for (;;) {
+        char *saved_next_out;
+
         Py_BEGIN_ALLOW_THREADS
+        saved_next_out = bzs->next_out;
         bzerror = BZ2_bzCompress(bzs, BZ_FINISH);
+        output_size += bzs->next_out - saved_next_out;
         Py_END_ALLOW_THREADS
+
         if (bzerror == BZ_STREAM_END) {
             break;
         } else if (bzerror != BZ_FINISH_OK) {
@@ -1723,18 +1731,20 @@ BZ2Comp_flush(BZ2CompObject *self)
             goto error;
         }
         if (bzs->avail_out == 0) {
-            bufsize = Util_NewBufferSize(bufsize);
+            size_t buffer_left = PyString_GET_SIZE(ret) - output_size;
-            if (_PyString_Resize(&ret, bufsize) < 0)
+            if (buffer_left == 0) {
-                goto error;
+                if (Util_GrowBuffer(&ret) < 0)
-            bzs->next_out = BUF(ret);
+                    goto error;
-            bzs->next_out = BUF(ret) + (BZS_TOTAL_OUT(bzs)
+                bzs->next_out = BUF(ret) + output_size;
-                                        - totalout);
+                buffer_left = PyString_GET_SIZE(ret) - output_size;
-            bzs->avail_out = bufsize - (bzs->next_out - BUF(ret));
+            }
+            bzs->avail_out = MIN(buffer_left, UINT_MAX);
         }
     }
 
-    if (bzs->avail_out != 0)
+    if (output_size != PyString_GET_SIZE(ret))
-        _PyString_Resize(&ret, (Py_ssize_t)(BZS_TOTAL_OUT(bzs) - totalout));
+        if (_PyString_Resize(&ret, output_size) < 0)
+            goto error;
 
     RELEASE_LOCK(self);
     return ret;
@@ -1899,18 +1909,14 @@ static PyObject *
 BZ2Decomp_decompress(BZ2DecompObject *self, PyObject *args)
 {
     Py_buffer pdata;
-    char *data;
+    size_t input_left;
-    int datasize;
+    size_t output_size = 0;
-    int bufsize = SMALLCHUNK;
-    PY_LONG_LONG totalout;
     PyObject *ret = NULL;
     bz_stream *bzs = &self->bzs;
     int bzerror;
 
     if (!PyArg_ParseTuple(args, "s*:decompress", &pdata))
         return NULL;
-    data = pdata.buf;
-    datasize = pdata.len;
 
     ACQUIRE_LOCK(self);
     if (!self->running) {
@@ -1919,52 +1925,65 @@ BZ2Decomp_decompress(BZ2DecompObject *self, PyObject *args)
         goto error;
     }
 
-    ret = PyString_FromStringAndSize(NULL, bufsize);
+    ret = PyString_FromStringAndSize(NULL, SMALLCHUNK);
     if (!ret)
         goto error;
 
-    bzs->next_in = data;
+    bzs->next_in = pdata.buf;
-    bzs->avail_in = datasize;
+    bzs->avail_in = MIN(pdata.len, UINT_MAX);
-    bzs->next_out = BUF(ret);
+    input_left = pdata.len - bzs->avail_in;
-    bzs->avail_out = bufsize;
 
-    totalout = BZS_TOTAL_OUT(bzs);
+    bzs->next_out = BUF(ret);
+    bzs->avail_out = PyString_GET_SIZE(ret);
 
     for (;;) {
+        char *saved_next_out;
+
         Py_BEGIN_ALLOW_THREADS
+        saved_next_out = bzs->next_out;
         bzerror = BZ2_bzDecompress(bzs);
+        output_size += bzs->next_out - saved_next_out;
         Py_END_ALLOW_THREADS
+
         if (bzerror == BZ_STREAM_END) {
-            if (bzs->avail_in != 0) {
+            self->running = 0;
+            input_left += bzs->avail_in;
+            if (input_left != 0) {
                 Py_DECREF(self->unused_data);
                 self->unused_data =
-                    PyString_FromStringAndSize(bzs->next_in,
+                    PyString_FromStringAndSize(bzs->next_in, input_left);
-                                               bzs->avail_in);
+                if (self->unused_data == NULL)
+                    goto error;
             }
-            self->running = 0;
             break;
         }
         if (bzerror != BZ_OK) {
             Util_CatchBZ2Error(bzerror);
             goto error;
         }
-        if (bzs->avail_in == 0)
+        if (bzs->avail_in == 0) {
-            break; /* no more input data */
+            if (input_left == 0)
+                break; /* no more input data */
+            bzs->avail_in = MIN(input_left, UINT_MAX);
+            input_left -= bzs->avail_in;
+        }
         if (bzs->avail_out == 0) {
-            bufsize = Util_NewBufferSize(bufsize);
+            size_t buffer_left = PyString_GET_SIZE(ret) - output_size;
-            if (_PyString_Resize(&ret, bufsize) < 0) {
+            if (buffer_left == 0) {
-                BZ2_bzDecompressEnd(bzs);
+                if (Util_GrowBuffer(&ret) < 0) {
-                goto error;
+                    BZ2_bzDecompressEnd(bzs);
+                    goto error;
+                }
+                bzs->next_out = BUF(ret) + output_size;
+                buffer_left = PyString_GET_SIZE(ret) - output_size;
             }
-            bzs->next_out = BUF(ret);
+            bzs->avail_out = MIN(buffer_left, UINT_MAX);
-            bzs->next_out = BUF(ret) + (BZS_TOTAL_OUT(bzs)
-                                        - totalout);
-            bzs->avail_out = bufsize - (bzs->next_out - BUF(ret));
         }
     }
 
-    if (bzs->avail_out != 0)
+    if (output_size != PyString_GET_SIZE(ret))
-        _PyString_Resize(&ret, (Py_ssize_t)(BZS_TOTAL_OUT(bzs) - totalout));
+        if (_PyString_Resize(&ret, output_size) < 0)
+            goto error;
 
     RELEASE_LOCK(self);
     PyBuffer_Release(&pdata);
@@ -2111,10 +2130,10 @@ static PyObject *
 bz2_compress(PyObject *self, PyObject *args, PyObject *kwargs)
 {
     int compresslevel=9;
+    int action;
     Py_buffer pdata;
-    char *data;
+    size_t input_left;
-    int datasize;
+    size_t output_size = 0;
-    int bufsize;
     PyObject *ret = NULL;
     bz_stream _bzs;
     bz_stream *bzs = &_bzs;
@@ -2125,8 +2144,6 @@ bz2_compress(PyObject *self, PyObject *args, PyObject *kwargs)
                                      kwlist, &pdata,
                                      &compresslevel))
         return NULL;
-    data = pdata.buf;
-    datasize = pdata.len;
 
     if (compresslevel < 1 || compresslevel > 9) {
         PyErr_SetString(PyExc_ValueError,
@@ -2135,11 +2152,7 @@ bz2_compress(PyObject *self, PyObject *args, PyObject *kwargs)
         return NULL;
     }
 
-    /* Conforming to bz2 manual, this is large enough to fit compressed
+    ret = PyString_FromStringAndSize(NULL, SMALLCHUNK);
-     * data in one shot. We will check it later anyway. */
-    bufsize = datasize + (datasize/100+1) + 600;
-
-    ret = PyString_FromStringAndSize(NULL, bufsize);
     if (!ret) {
         PyBuffer_Release(&pdata);
         return NULL;
@@ -2147,10 +2160,12 @@ bz2_compress(PyObject *self, PyObject *args, PyObject *kwargs)
 
     memset(bzs, 0, sizeof(bz_stream));
 
-    bzs->next_in = data;
+    bzs->next_in = pdata.buf;
-    bzs->avail_in = datasize;
+    bzs->avail_in = MIN(pdata.len, UINT_MAX);
+    input_left = pdata.len - bzs->avail_in;
+
     bzs->next_out = BUF(ret);
-    bzs->avail_out = bufsize;
+    bzs->avail_out = PyString_GET_SIZE(ret);
 
     bzerror = BZ2_bzCompressInit(bzs, compresslevel, 0, 0);
     if (bzerror != BZ_OK) {
@@ -2160,36 +2175,53 @@ bz2_compress(PyObject *self, PyObject *args, PyObject *kwargs)
         return NULL;
     }
 
+    action = BZ_RUN;
+
     for (;;) {
+        char *saved_next_out;
+
         Py_BEGIN_ALLOW_THREADS
-        bzerror = BZ2_bzCompress(bzs, BZ_FINISH);
+        saved_next_out = bzs->next_out;
+        bzerror = BZ2_bzCompress(bzs, action);
+        output_size += bzs->next_out - saved_next_out;
         Py_END_ALLOW_THREADS
+
         if (bzerror == BZ_STREAM_END) {
             break;
-        } else if (bzerror != BZ_FINISH_OK) {
+        } else if (bzerror != BZ_RUN_OK && bzerror != BZ_FINISH_OK) {
             BZ2_bzCompressEnd(bzs);
             Util_CatchBZ2Error(bzerror);
             PyBuffer_Release(&pdata);
             Py_DECREF(ret);
             return NULL;
         }
-        if (bzs->avail_out == 0) {
+        if (action == BZ_RUN && bzs->avail_in == 0) {
-            bufsize = Util_NewBufferSize(bufsize);
+            if (input_left == 0) {
-            if (_PyString_Resize(&ret, bufsize) < 0) {
+                action = BZ_FINISH;
-                BZ2_bzCompressEnd(bzs);
+            } else {
-                PyBuffer_Release(&pdata);
+                bzs->avail_in = MIN(input_left, UINT_MAX);
-                Py_DECREF(ret);
+                input_left -= bzs->avail_in;
-                return NULL;
             }
-            bzs->next_out = BUF(ret) + BZS_TOTAL_OUT(bzs);
+        }
-            bzs->avail_out = bufsize - (bzs->next_out - BUF(ret));
+        if (bzs->avail_out == 0) {
+            size_t buffer_left = PyString_GET_SIZE(ret) - output_size;
+            if (buffer_left == 0) {
+                if (Util_GrowBuffer(&ret) < 0) {
+                    BZ2_bzCompressEnd(bzs);
+                    PyBuffer_Release(&pdata);
+                    return NULL;
+                }
+                bzs->next_out = BUF(ret) + output_size;
+                buffer_left = PyString_GET_SIZE(ret) - output_size;
+            }
+            bzs->avail_out = MIN(buffer_left, UINT_MAX);
         }
     }
 
-    if (bzs->avail_out != 0)
+    if (output_size != PyString_GET_SIZE(ret))
-        _PyString_Resize(&ret, (Py_ssize_t)BZS_TOTAL_OUT(bzs));
+        _PyString_Resize(&ret, output_size);  /* Sets ret to NULL on failure. */
-    BZ2_bzCompressEnd(bzs);
 
+    BZ2_bzCompressEnd(bzs);
     PyBuffer_Release(&pdata);
     return ret;
 }
@@ -2205,9 +2237,8 @@ static PyObject *
 bz2_decompress(PyObject *self, PyObject *args)
 {
     Py_buffer pdata;
-    char *data;
+    size_t input_left;
-    int datasize;
+    size_t output_size = 0;
-    int bufsize = SMALLCHUNK;
     PyObject *ret;
     bz_stream _bzs;
     bz_stream *bzs = &_bzs;
@@ -2215,15 +2246,13 @@ bz2_decompress(PyObject *self, PyObject *args)
 
     if (!PyArg_ParseTuple(args, "s*:decompress", &pdata))
         return NULL;
-    data = pdata.buf;
-    datasize = pdata.len;
 
-    if (datasize == 0) {
+    if (pdata.len == 0) {
         PyBuffer_Release(&pdata);
         return PyString_FromString("");
     }
 
-    ret = PyString_FromStringAndSize(NULL, bufsize);
+    ret = PyString_FromStringAndSize(NULL, SMALLCHUNK);
     if (!ret) {
         PyBuffer_Release(&pdata);
         return NULL;
@@ -2231,10 +2260,12 @@ bz2_decompress(PyObject *self, PyObject *args)
 
     memset(bzs, 0, sizeof(bz_stream));
 
-    bzs->next_in = data;
+    bzs->next_in = pdata.buf;
-    bzs->avail_in = datasize;
+    bzs->avail_in = MIN(pdata.len, UINT_MAX);
+    input_left = pdata.len - bzs->avail_in;
+
     bzs->next_out = BUF(ret);
-    bzs->avail_out = bufsize;
+    bzs->avail_out = PyString_GET_SIZE(ret);
 
     bzerror = BZ2_bzDecompressInit(bzs, 0, 0);
     if (bzerror != BZ_OK) {
@@ -2245,9 +2276,14 @@ bz2_decompress(PyObject *self, PyObject *args)
     }
 
     for (;;) {
+        char *saved_next_out;
+
         Py_BEGIN_ALLOW_THREADS
+        saved_next_out = bzs->next_out;
         bzerror = BZ2_bzDecompress(bzs);
+        output_size += bzs->next_out - saved_next_out;
         Py_END_ALLOW_THREADS
+
         if (bzerror == BZ_STREAM_END) {
             break;
         } else if (bzerror != BZ_OK) {
@@ -2258,31 +2294,37 @@ bz2_decompress(PyObject *self, PyObject *args)
             return NULL;
         }
         if (bzs->avail_in == 0) {
-            BZ2_bzDecompressEnd(bzs);
+            if (input_left == 0) {
-            PyErr_SetString(PyExc_ValueError,
-                            "couldn't find end of stream");
-            PyBuffer_Release(&pdata);
-            Py_DECREF(ret);
-            return NULL;
-        }
-        if (bzs->avail_out == 0) {
-            bufsize = Util_NewBufferSize(bufsize);
-            if (_PyString_Resize(&ret, bufsize) < 0) {
                 BZ2_bzDecompressEnd(bzs);
+                PyErr_SetString(PyExc_ValueError,
+                                "couldn't find end of stream");
                 PyBuffer_Release(&pdata);
                 Py_DECREF(ret);
                 return NULL;
             }
-            bzs->next_out = BUF(ret) + BZS_TOTAL_OUT(bzs);
+            bzs->avail_in = MIN(input_left, UINT_MAX);
-            bzs->avail_out = bufsize - (bzs->next_out - BUF(ret));
+            input_left -= bzs->avail_in;
+        }
+        if (bzs->avail_out == 0) {
+            size_t buffer_left = PyString_GET_SIZE(ret) - output_size;
+            if (buffer_left == 0) {
+                if (Util_GrowBuffer(&ret) < 0) {
+                    BZ2_bzDecompressEnd(bzs);
+                    PyBuffer_Release(&pdata);
+                    return NULL;
+                }
+                bzs->next_out = BUF(ret) + output_size;
+                buffer_left = PyString_GET_SIZE(ret) - output_size;
+            }
+            bzs->avail_out = MIN(buffer_left, UINT_MAX);
         }
     }
 
-    if (bzs->avail_out != 0)
+    if (output_size != PyString_GET_SIZE(ret))
-        _PyString_Resize(&ret, (Py_ssize_t)BZS_TOTAL_OUT(bzs));
+        _PyString_Resize(&ret, output_size);  /* Sets ret to NULL on failure. */
+
     BZ2_bzDecompressEnd(bzs);
     PyBuffer_Release(&pdata);
-
     return ret;
 }