gh-156002: Keep reading through third-party zipfile decompressors

GH-156003 made ZipExtFile._read1() call decompress(data, max_length) on
non-deflate decompressors and consult needs_input before reading more. A
decompressor installed by replacing _get_decompressor() (zipfile-zstd,
zipfile-deflate64, ...) may support neither, and every read through it
then failed with AttributeError.

Give _decompressor_needs_input() a default for decompressors that report
nothing, and only take the bounded path for decompressors that do report
needs_input (the stdlib ones); others are read unbounded, as before.

Author: rasmusfaber

Lib/test/test_zipfile/test_core.py

@@ -4916,6 +4916,64 @@ class ZstdBoundedDecompressTests(AbstractBoundedDecompressTests,
     compression = zipfile.ZIP_ZSTANDARD
 
 
+class ThirdPartyDecompressorTests(unittest.TestCase):
+    # A decompressor installed by replacing _get_decompressor() may support
+    # neither decompress(data, max_length) nor needs_input.  ZipExtFile must
+    # still read through it (unbounded, as before bounded decompression).
+    COMPRESSION = 99
+
+    class Compressor:
+        def compress(self, data):
+            return data
+
+        def flush(self):
+            return b''
+
+    class Decompressor:
+        eof = False
+
+        def decompress(self, data):
+            return data
+
+    def setUp(self):
+        orig_check_compression = zipfile._check_compression
+        orig_get_compressor = zipfile._get_compressor
+        orig_get_decompressor = zipfile._get_decompressor
+
+        def check_compression(compression):
+            if compression != self.COMPRESSION:
+                orig_check_compression(compression)
+
+        def get_compressor(compress_type, compresslevel=None):
+            if compress_type == self.COMPRESSION:
+                return self.Compressor()
+            return orig_get_compressor(compress_type, compresslevel)
+
+        def get_decompressor(compress_type):
+            if compress_type == self.COMPRESSION:
+                return self.Decompressor()
+            return orig_get_decompressor(compress_type)
+
+        self.enterContext(mock.patch.object(
+            zipfile, '_check_compression', check_compression))
+        self.enterContext(mock.patch.object(
+            zipfile, '_get_compressor', get_compressor))
+        self.enterContext(mock.patch.object(
+            zipfile, '_get_decompressor', get_decompressor))
+
+    def test_read_through_third_party_decompressor(self):
+        data = bytes(range(256)) * 256
+        buf = io.BytesIO()
+        with zipfile.ZipFile(buf, "w", compression=self.COMPRESSION) as zf:
+            zf.writestr("member", data)
+        with zipfile.ZipFile(io.BytesIO(buf.getvalue())) as zf:
+            self.assertEqual(zf.read("member"), data)
+            with zf.open("member") as f:
+                self.assertEqual(f.read(100), data[:100])
+                f.seek(-100, os.SEEK_END)
+                self.assertEqual(f.read(), data[-100:])
+
+
 class AbstractBadCrcTests:
     def test_testzip_with_bad_crc(self):
         """Tests that files with bad CRCs return their name from testzip."""

Lib/zipfile/__init__.py

@@ -893,11 +893,23 @@ def _get_compressor(compress_type, compresslevel=None):
         return None
 
 
-def _decompressor_needs_input(decompressor):
+def _decompressor_needs_input(decompressor, default):
     # bz2/zstd expose the stdlib decompressor's public needs_input; the LZMA
     # wrapper keeps it private (_needs_input) to avoid adding public API.
+    # A decompressor with neither attribute reports *default*.
     needs_input = getattr(decompressor, "needs_input", None)
-    return decompressor._needs_input if needs_input is None else needs_input
+    if needs_input is None:
+        needs_input = getattr(decompressor, "_needs_input", default)
+    return needs_input
+
+
+def _decompressor_bounds_output(decompressor):
+    # The stdlib bzip2/LZMA/Zstandard decompressors report needs_input and
+    # accept decompress(data, max_length).  A third-party decompressor
+    # installed by replacing _get_decompressor() may support neither; it is
+    # then read unbounded, as before the bounded-decompression fix.
+    return (hasattr(decompressor, "needs_input")
+            or hasattr(decompressor, "_needs_input"))
 
 
 def _get_decompressor(compress_type):
@@ -1007,7 +1019,7 @@ def __init__(self, fileobj, mode, zipinfo, pwd=None,
         self._compress_left = zipinfo.compress_size
         self._left = zipinfo.file_size
 
-        self._decompressor = _get_decompressor(self._compress_type)
+        self._set_decompressor()
 
         self._eof = False
         self._readbuffer = b''
@@ -1190,6 +1202,10 @@ def read1(self, n):
                     break
         return buf
 
+    def _set_decompressor(self):
+        self._decompressor = _get_decompressor(self._compress_type)
+        self._decompress_bounded = _decompressor_bounds_output(self._decompressor)
+
     def _read1(self, n):
         # Read up to n compressed bytes with at most one read() system call,
         # decrypt and decompress them.
@@ -1207,7 +1223,7 @@ def _read1(self, n):
         else:
             # bzip2/lzma/zstd: a bounded decompress() call may leave input
             # buffered inside the decompressor; drain that before reading more.
-            if _decompressor_needs_input(self._decompressor):
+            if _decompressor_needs_input(self._decompressor, default=True):
                 data = self._read2(n)
             else:
                 data = b''
@@ -1222,14 +1238,17 @@ def _read1(self, n):
                          not self._decompressor.unconsumed_tail)
             if self._eof:
                 data += self._decompressor.flush()
-        else:
+        elif self._decompress_bounded:
             # Bound the output of a single decompress() call (mirroring the
             # DEFLATE path above) so that a small compressed member cannot
             # expand into one unbounded read.
             data = self._decompressor.decompress(data, max(n, self.MIN_READ_SIZE))
             self._eof = (self._decompressor.eof or
                          self._compress_left <= 0 and
-                         _decompressor_needs_input(self._decompressor))
+                         _decompressor_needs_input(self._decompressor, default=True))
+        else:
+            data = self._decompressor.decompress(data)
+            self._eof = self._decompressor.eof or self._compress_left <= 0
 
         data = data[:self._left]
         self._left -= len(data)
@@ -1318,7 +1337,7 @@ def seek(self, offset, whence=os.SEEK_SET):
             self._left = self._orig_file_size
             self._readbuffer = b''
             self._offset = 0
-            self._decompressor = _get_decompressor(self._compress_type)
+            self._set_decompressor()
             self._eof = False
             read_offset = new_pos
             if self._decrypter is not None:

Misc/NEWS.d/next/Library/2026-09-08-13-06-29.gh-issue-156002.vmOC8T.rst

@@ -0,0 +1,5 @@
+:mod:`zipfile` again reads members through a third-party decompressor
+installed by replacing ``_get_decompressor()``, unbounded as before the
+bounded-decompression fix, instead of raising :exc:`AttributeError`. The
+bound still applies to the standard library's bzip2, LZMA and Zstandard
+decompressors.