{"id":51015046,"url":"https://github.com/securityronin/lzo","last_synced_at":"2026-06-21T09:02:32.436Z","repository":{"id":363040737,"uuid":"1261748480","full_name":"SecurityRonin/lzo","owner":"SecurityRonin","description":"GPL-free, safe, no_std pure-Rust LZO1X decompressor — decode lzo1x_1 / lzo1x_999 streams (lzop, kernel/initramfs, btrfs, liblzo2) with zero C, zero dependencies, and #![forbid(unsafe_code)]; validated against liblzo2 and fuzz-hardened against malicious input.","archived":false,"fork":false,"pushed_at":"2026-06-18T05:07:15.000Z","size":85,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-18T07:12:23.978Z","etag":null,"topics":["compression","decompression","forensics","lzo","lzo1x","lzop","no-std","pure-rust","rust","safe"],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SecurityRonin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-07T05:15:14.000Z","updated_at":"2026-06-18T05:07:19.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/SecurityRonin/lzo","commit_stats":null,"previous_names":["securityronin/lzo"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/SecurityRonin/lzo","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Flzo","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Flzo/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Flzo/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Flzo/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SecurityRonin","download_url":"https://codeload.github.com/SecurityRonin/lzo/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Flzo/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34603628,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-21T02:00:05.568Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["compression","decompression","forensics","lzo","lzo1x","lzop","no-std","pure-rust","rust","safe"],"created_at":"2026-06-21T09:02:31.686Z","updated_at":"2026-06-21T09:02:32.430Z","avatar_url":"https://github.com/SecurityRonin.png","language":"Rust","funding_links":["https://github.com/sponsors/h4x0r"],"categories":[],"sub_categories":[],"readme":"# lzo\n\n[![Crates.io](https://img.shields.io/crates/v/lzo.svg)](https://crates.io/crates/lzo)\n[![Docs.rs](https://docs.rs/lzo/badge.svg)](https://docs.rs/lzo)\n[![License: Apache-2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)\n[![CI](https://github.com/SecurityRonin/lzo/actions/workflows/ci.yml/badge.svg)](https://github.com/SecurityRonin/lzo/actions/workflows/ci.yml)\n[![Sponsor](https://img.shields.io/badge/Sponsor-%E2%9D%A4-db61a2.svg)](https://github.com/sponsors/h4x0r)\n\n**The safe, `no_std`, zero-dependency pure-Rust LZO1X decompressor — hardened and fuzzed against malicious input.** Decode `lzo1x` data — from `lzop` files, the Linux kernel/initramfs, btrfs, or any tool built on liblzo2 — with zero C, zero dependencies, and `#![forbid(unsafe_code)]`.\n\n```rust\n// \"hello, lzo world!\" as a raw LZO1X block (from liblzo2's lzo1x_1).\nlet block = [34, 104,101,108,108,111,44,32,108,122,111,32,119,111,114,108,100,33, 17,0,0];\nlet mut out = [0u8; 17];                 // you supply the output capacity\nlet n = lzo::decompress_into(\u0026block, \u0026mut out).unwrap();\nassert_eq!(\u0026out[..n], b\"hello, lzo world!\");\n```\n\nThat's it: hand it a raw block and a big-enough buffer, get the bytes back.\n\n## Why this crate\n\nLZO turns up in forensics and recovery — `lzop` archives, kernel/initramfs images, btrfs, anything built on liblzo2 — and there the bytes are often **untrusted, truncated, or deliberately malformed**. `lzo` is built decoder-first around the property that matters most there: **it cannot be made to misbehave on hostile input.**\n\n- **Safe by construction** — `#![forbid(unsafe_code)]`, so every read is bounds-checked by the compiler. A corrupt or crafted block returns a typed [`Error`] — it can never read out of bounds, loop forever, or corrupt memory.\n- **Fuzzed hard before release** — millions of arbitrary and mutation-fuzzed inputs through a libFuzzer target and a differential harness; it panics on none. Cross-validated byte-for-byte against the independent `rust-lzo` decoder on real data and across 3M mutated inputs with zero divergence (see [Correctness](#correctness)).\n- **Zero dependencies, `no_std`** — the core `decompress_into` needs no allocator and pulls in nothing to audit but this crate.\n- **Apache-2.0-licensed** — drops cleanly into permissively-licensed projects.\n\nIt decodes streams from every `lzo1x` compressor variant (`lzo1x_1`, `lzo1x_1_15`, `lzo1x_999`) — they share one decompressor. (Other Rust LZO crates exist — [`rust-lzo`](https://crates.io/crates/rust-lzo), [`lzo1x`](https://crates.io/crates/lzo1x), [`lzokay`](https://crates.io/crates/lzokay) — with different trade-offs in licence, dependencies, and `unsafe`; `lzo`'s niche is the safe, zero-dependency decoder.)\n\n## Scope\n\n- **Decompression only** (v1). Like `ruzstd`/`bzip2-rs`, this is a decoder; raw LZO1X has no container, so you supply the output capacity (mirroring C `lzo1x_decompress_safe`).\n- Standard `lzo1x` streams. The kernel's bitstream-version (RLE) extension is out of scope.\n\n## Correctness\n\nEvery release is round-trip tested against vectors produced by the **reference C `liblzo2`** — `lzo` decodes, liblzo2 encoded, so the two share no code and a mismatch can only mean `lzo` is wrong. The vectors cover literals, the zero-byte length extension, M1–M4 matches, overlapping copies, and the end-of-stream marker, plus malformed-input tests asserting no panic on arbitrary bytes.\n\nBeyond the committed vectors, `lzo` has decoded **32.4 MB of real-world data** — a 2.5 MB dictionary, real Mach-O binaries, a 6 MB photo, an already-gzipped blob, real source and prose — compressed by all three liblzo2 variants (`lzo1x_1`, `lzo1x_1_15`, `lzo1x_999`), every block byte-exact.\n\nAs a second, lineage-independent check, `lzo`'s output was compared against [`rust-lzo`](https://crates.io/crates/rust-lzo) (a separate GPL decoder converted from Linux's `lzo1x_decompress_safe`, used only as a local oracle — never a dependency): identical on all 27 real blocks, and across **3,000,000** mutation-fuzz inputs there were **zero** output divergences (903k accepted by both decoders) and zero accept/reject splits. Full methodology, results, and scope limits: **[docs/validation.md](docs/validation.md)**.\n\n[Privacy Policy](https://securityronin.github.io/lzo/privacy/) · [Terms of Service](https://securityronin.github.io/lzo/terms/) · © 2026 Security Ronin Ltd\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Flzo","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsecurityronin%2Flzo","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Flzo/lists"}