Skip to content

fix: cap decompress() buffer at 256 MB to prevent zip bomb OOM#22277

Open
johnathan79717 wants to merge 1 commit intomerge-train/barretenbergfrom
jh/fix-decompress-zip-bomb-dos
Open

fix: cap decompress() buffer at 256 MB to prevent zip bomb OOM#22277
johnathan79717 wants to merge 1 commit intomerge-train/barretenbergfrom
jh/fix-decompress-zip-bomb-dos

Conversation

@johnathan79717
Copy link
Copy Markdown
Contributor

@johnathan79717 johnathan79717 commented Apr 2, 2026

Summary

  • Adds a 256 MB cap to the decompression buffer doubling loop in decompress(), preventing a gzip zip bomb from causing OOM via unbounded allocation
  • Real IVC inputs decompress to low single-digit MBs, so 256 MB is generous headroom

Closes AztecProtocol/barretenberg-claude#2441

@johnathan79717 johnathan79717 added the ci-barretenberg Run all barretenberg/cpp checks. label Apr 2, 2026
@johnathan79717 johnathan79717 requested a review from ludamad April 2, 2026 14:56
@johnathan79717 johnathan79717 enabled auto-merge (squash) April 2, 2026 16:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ludamad ludamad Awaiting requested review from ludamad

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

ci-barretenberg Run all barretenberg/cpp checks.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@johnathan79717