fix(processor): bound decompressed document size to prevent decompression bombs#3076
Open
kanywst wants to merge 1 commit into
Open
fix(processor): bound decompressed document size to prevent decompression bombs#3076kanywst wants to merge 1 commit into
kanywst wants to merge 1 commit into
Conversation
kanywst
force-pushed
the
fix/decompression-bomb-limit
branch
from
8abb629 to
e6b3949
Compare
…sion bombs decompressDocument read the bzip2/zstd stream with io.ReadAll and no size limit, so a small compressed document could expand to an arbitrary size and exhaust the processor's memory. The encoding is auto-detected from the blob's magic bytes, so any ingested artifact can trigger this. Wrap the reader in an io.LimitReader and reject documents that exceed the limit, matching the existing object-size handling in the blob collector. Signed-off-by: kanywst <niwatakuma@icloud.com>
kanywst
force-pushed
the
fix/decompression-bomb-limit
branch
from
e6b3949 to
e6e80a2
Compare
mihaimaruseac
approved these changes
Jun 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of the PR
decompressDocumentread the bzip2/zstd stream withio.ReadAlland no size limit, so a small compressed document could expand to an arbitrary size and exhaust the processor's memory. The encoding is auto-detected from the blob's magic bytes, so any ingested artifact can reach this path.This bounds the decompressed size with
io.LimitReaderand rejects documents that exceed the limit, matching the object-size handling already used by the blob collector (pkg/handler/collector/blob/blob.go). A 56 KB zstd input previously materialized 500 MiB in memory; it is now rejected once it passes the limit.Fixes #3075
PR Checklist
-sflag togit commit.make generatehas been runmake generatehas been runmake generatehas been runcollectsubprotobuf has been changed,make protohas been run