[3.13] gh-156002: Bound zipfile decompression for bzip2/LZMA (GH-156003) (GH-156362)

[miss-islington]

Patch by @tonghuaroot.

zipfile.ZipExtFile._read1() bounds the output of each decompress() call
for DEFLATE members by passing a max_length to zlib, but for bzip2 and LZMA,
members it called decompress() with no bound. A whole
compressed chunk was therefore expanded into a single allocation before
the data[:self._left] clip ran, so a consumer that deliberately reads in
small chunks to limit memory (for example zf.open(name).read(8192)) was
silently unprotected for non-DEFLATE members. A small, spec-conformant
archive member declaring a large uncompressed size could drive multi-GB
peak memory.

_read1() now passes a per-call bound to the non-DEFLATE decompress()
(mirroring the DEFLATE branch) and drains the decompressor's internal
buffer across calls by checking needs_input before reading more
compressed input. zipfile's LZMADecompressor wrapper forwards max_length
and exposes needs_input so the bound also holds for LZMA members.

(cherry picked from commit f897dbf)
(cherry picked from commit 1b424c0)

Co-authored-by: Petr Viktorin encukou@gmail.com
Co-authored-by: tonghuaroot tonghuaroot@gmail.com

• Issue: Memory exhaustion via crafted zip file #156002

[StanFromIreland]

CC @encukou

This needs adaptations for 3.13, which does not support Zstandard:

Traceback (most recent call last):
  File "/home/runner/work/cpython/installed-python/lib/python3.13/unittest/loader.py", line 403, in _find_test_path
    module = self._get_module_from_name(name)
  File "/home/runner/work/cpython/installed-python/lib/python3.13/unittest/loader.py", line 346, in _get_module_from_name
    __import__(name)
    ~~~~~~~~~~^^^^^^
  File "/home/runner/work/cpython/installed-python/lib/python3.13/test/test_zipfile/test_core.py", line 2658, in <module>
    @requires_zstd()
     ^^^^^^^^^^^^^
NameError: name 'requires_zstd' is not defined. Did you mean: 'requires_zlib'?

[encukou]

Indeed. Removed in all lower backports, thanks!