romenskiy2012/curl

mirror of https://github.com/curl/curl.git synced 2026-04-14 18:21:40 +03:00

Daniel Stenberg 77ed315096

progress: count amount of data "delivered" to application

... and apply the CURLOPT_MAXFILESIZE limit (if set) on that as well.
This effectively protects the user against "zip bombs".

Test case 1618 verifies using a 14 byte brotli payload that otherwise
explodes to 102400 zero bytes.

Closes #20787

2026-03-21 23:21:55 +01:00

1.9 KiB

Raw Blame History

SPDX-License-Identifier

Title

Section

Source

See-also

Protocol

Added-in

curl

CURLOPT_MAXFILESIZE_LARGE

libcurl

CURLOPT_MAXFILESIZE (3)

CURLOPT_MAX_RECV_SPEED_LARGE (3)

FTP

HTTP

MQTT

7.11.0

NAME

CURLOPT_MAXFILESIZE_LARGE - maximum file size allowed to download

SYNOPSIS

#include <curl/curl.h>

CURLcode curl_easy_setopt(CURL *handle, CURLOPT_MAXFILESIZE_LARGE,
                          curl_off_t size);

DESCRIPTION

Pass a curl_off_t as parameter. This specifies the maximum accepted size (in bytes) of a file to download. If the file requested is found larger than this value, the transfer is aborted and CURLE_FILESIZE_EXCEEDED is returned. Passing a zero size disables this, and passing a negative size yields a CURLE_BAD_FUNCTION_ARGUMENT.

The file size is not always known prior to the download start, and for such transfers this option has no effect - even if the file transfer eventually ends up being larger than this given limit.

Since 8.4.0, this option also stops ongoing transfers if they reach this threshold.

Since 8.20.0, this option also stops ongoing transfers that would reach this threshold due to automatic decompression using CURLOPT_ACCEPT_ENCODING(3).

DEFAULT

0, meaning disabled.

%PROTOCOLS%

EXAMPLE

int main(void)
{
  CURL *curl = curl_easy_init();
  if(curl) {
    CURLcode result;
    curl_off_t ridiculous = (curl_off_t)1 << 48;
    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/");
    /* refuse to download if larger than ridiculous */
    curl_easy_setopt(curl, CURLOPT_MAXFILESIZE_LARGE, ridiculous);
    result = curl_easy_perform(curl);
  }
}

%AVAILABILITY%

RETURN VALUE

curl_easy_setopt(3) returns a CURLcode indicating success or error.

CURLE_OK (0) means everything was OK, non-zero means an error occurred, see libcurl-errors(3).

1.9 KiB Raw Blame History