Module decompression 

Shared decompression limits used to prevent decompression-bomb (DoS) attacks.

A length or compressed payload read from an untrusted peer must never drive an unbounded in-memory allocation. This module owns the global decompressed-size cap and the helpers that enforce it, so every source and codec that decompresses untrusted input shares a single, consistently-configured limit.

Usage

Wrap any decompression at an untrusted boundary with the appropriate CappedDecoder constructor and call CappedDecoder::decompress:

let data = CappedDecoder::gzip(reader).decompress()?;
let data = CappedDecoder::zlib(reader).decompress()?;
let data = CappedDecoder::zstd(reader)?.decompress()?;

The constructors enforce the global decompressed-size cap so that a compression bomb cannot drive unbounded allocation.

Structs

CappedDecoder

A size-capped decompression reader.

CappedReader

A streaming, size-capped decompression reader returned by CappedDecoder::into_reader.

DecompressedSizeLimitExceeded

Error raised when a decompressed payload would exceed the configured size cap.

Constants

DEFAULT_MAX_DECOMPRESSED_SIZE_BYTES

Default cap on the size of any decompressed payload.

HTTP_ZSTD_WINDOW_LOG_MAX

RFC 9659 window ceiling for zstd under HTTP Content-Encoding: zstd: conformant senders require a Window_Size of at most 8 MB (2^23) and decoders need only support up to that. This bounds the decoder’s window allocation to 8 MB regardless of the (much larger) decompressed cap. It governs HTTP content coding only; other transports (e.g. gRPC/OTLP, whose clients are not bound by RFC 9659 and may legitimately use larger windows) are not clamped to it. See https://www.rfc-editor.org/info/rfc9659/.

Functions

http_zstd_window_log_max

Like zstd_window_log_max but additionally clamped to the RFC 9659 HTTP window ceiling (HTTP_ZSTD_WINDOW_LOG_MAX). Use for HTTP Content-Encoding: zstd; use the protocol-neutral zstd_window_log_max for transports RFC 9659 does not govern.

is_decompressed_size_limit_error

Returns whether error was raised because decompression hit the size cap (see DecompressedSizeLimitExceeded).

max_decompressed_size_bytes

Returns the currently configured decompressed payload size cap.

max_zlib_compressed_frame_size_bytes

Returns the maximum compressed frame wire size we are willing to buffer, derived from the decompressed cap plus zlib’s worst-case expansion. See zlib_compressed_frame_limit.

max_zstd_window_log

Returns the zstd window_log_max derived from the global decompressed cap (max_decompressed_size_bytes).

set_max_decompressed_size_bytes

Override the global decompressed payload size cap. Must be called before any sources start.

zstd_window_log_max

Smallest zstd window_log_max capable of representing max_decompressed_size bytes.