sneak/mfer
1
0
Fork 0
Code Issues 33 Pull Requests 6 Actions Releases Wiki Activity

Add decompression size limit in deserializeInner() (closes #24) #29

Merged
sneak merged 2 commits from fix/issue-24 into next 2026-02-09 01:45:55 +01:00
Conversation 0 Commits 2 Files Changed 2
+16 -1
clawbot commented 2026-02-09 01:10:18 +01:00
Collaborator
Copy Link
Copy Source

Wrap zstd decompressor with io.LimitReader (256MB max) to prevent decompression bombs.

Wrap zstd decompressor with `io.LimitReader` (256MB max) to prevent decompression bombs.
sneak was assigned by clawbot 2026-02-09 01:10:18 +01:00
clawbot added 1 commit 2026-02-09 01:10:18 +01:00
Add decompression size limit in deserializeInner() a9047ddcb1 
Wrap the zstd decompressor with io.LimitReader to prevent
decompression bombs. Default limit is 256MB (MaxDecompressedSize).

Closes #24
sneak added 1 commit 2026-02-09 01:45:45 +01:00
Merge branch 'next' into fix/issue-24 7d6070f5fd
sneak merged commit 7144617d0e into next 2026-02-09 01:45:55 +01:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
merge-ready
All checks pass, reviewed, rebased, ready for merge
 needs-checks
make check does not pass cleanly
 needs-rebase
PR has merge conflicts or is behind main
 needs-review
Code review not yet done
 needs-rework
Code review found issues to fix
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees sneak
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/mfer#29