romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 13:33:33 +03:00
Code Issues Projects Releases Packages Wiki Activity

progress: count amount of data "delivered" to application

Browse source 
... and apply the CURLOPT_MAXFILESIZE limit (if set) on that as well.
This effectively protects the user against "zip bombs".

Test case 1618 verifies using a 14 byte brotli payload that otherwise
explodes to 102400 zero bytes.
This commit is contained in:
Daniel Stenberg 2026-03-02 11:02:03 +01:00
parent 4b583b7585
commit d332b9057f
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
10 changed files with 115 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

3
docs/KNOWN_RISKS.md
View file

@ -144,3 +144,6 @@ and secure algorithms.
When asking curl or libcurl to automatically decompress data on arrival, there
is a risk that the size of the output from the decompression process ends up
many times larger than the input data size.
Since curl 8.20.0, users can mitigate this risk by setting the max filesize
option that also covers the decompressed size.

3
docs/cmdline-opts/max-filesize.md
View file

@ -37,3 +37,6 @@ threshold during transfer.
Starting in curl 8.19.0, the maximum size can be specified using a fraction as
in `2.5M` for two and a half megabytes. It only works with a period (`.`)
delimiter, independent of what your locale might prefer.
Since 8.20.0, this option also stops ongoing transfers that would reach this
threshold due to automatic decompression using --compressed.

3
docs/libcurl/opts/CURLOPT_MAXFILESIZE.md
View file

@ -41,6 +41,9 @@ If you want a limit above 2GB, use CURLOPT_MAXFILESIZE_LARGE(3).
Since 8.4.0, this option also stops ongoing transfers if they reach this
threshold.
Since 8.20.0, this option also stops ongoing transfers that would reach this
threshold due to automatic decompression using CURLOPT_ACCEPT_ENCODING(3).
# DEFAULT
0, meaning disabled.

3
docs/libcurl/opts/CURLOPT_MAXFILESIZE_LARGE.md
View file

@ -42,6 +42,9 @@ ends up being larger than this given limit.
Since 8.4.0, this option also stops ongoing transfers if they reach this
threshold.
Since 8.20.0, this option also stops ongoing transfers that would reach this
threshold due to automatic decompression using CURLOPT_ACCEPT_ENCODING(3).
# DEFAULT
0, meaning disabled.