1543218d3e
Motivation: It is impossible to know in advance how much memory will be needed to decompress a stream of bytes that was compressed using the DEFLATE algorithm. In theory, up to 1032 times the compressed size could be needed. For untrusted input, an attacker could exploit this to exhaust the memory pool. Modifications: ZlibDecoder and its subclasses now support an optional limit on the size of the decompressed buffer. By default, if the limit is reached, decompression stops and a DecompressionException is thrown. Behavior upon reaching the limit is modifiable by subclasses in case they desire something else. Result: The decompressed buffer can now be limited to a configurable size, thus mitigating the possibility of memory pool exhaustion. |
||
---|---|---|
.. | ||
main/java/io/netty/handler/codec | ||
test |