<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi Sungjin,<br>
<br>
I've recently dealt this with very same issue, albeit only as a
security hardening and a prevention measure; and, like you, I've
looked into the zlib C code that's bundled with erts and arrived at
that same conclusion.<br>
<br>
I was only able to limit it on a theoretical basis: the zlib guys
themselves state[1] that a maximum compression ratio of 1032:1 is
achievable (with big blobs of zeroes.) Therefore, if I want to limit
the uncompressed content to less than, let's say, 5 MiB, I'll only
accept compressed content of up to ~5 KiB. This thinking might be
missing something, though.<br>
<br>
If there's a better/cleaner way to deal with this, I would love to
know.<br>
<br>
Cheers,<br>
<br>
<br>
[1]: <a class="moz-txt-link-freetext" href="http://www.zlib.net/zlib_tech.html">http://www.zlib.net/zlib_tech.html</a><br>
<br>
<br>
<div class="moz-cite-prefix">On 24-09-2014 03:55, Park, Sungjin
wrote:<br>
</div>
<blockquote
cite="mid:CAP6n5fA=QWotUtEtjzFEovyqVcKvUzNtAPqMyvUCf5AqSpCzZw@mail.gmail.com"
type="cite">
<div dir="ltr">Hi, I'm about to report a problem with erlang's
zlib library interface which I think is a design flaw at this
point of time.
<div><br>
</div>
<div>We recently had some malicious packets which were not very
big in the first place but inflated to really big ones -
hundreds of megabytes each. As a result, the server crashed
with out-of-memory by the processes calling zlib:inflate/2.
Urgency forced us to make a custom NIF library with inflation
size limit. We also studied erlang reference manual but
couldn't find anything useful. The zlib library source code
shows even zlib:setBufSize/2 does not prevent producing very
big binaries.</div>
<div><br>
</div>
<div>Not being able to know how big the data would become after
inflation, it should be a quite common problem. So I'm
curious if I missed something very simple and nice. Is there
anything like that?</div>
<div>
<div><br>
</div>
-- <br>
Park, Sungjin
<div>-------------------------------------------------------------------------------------------------------------------</div>
<div>Peculiar travel suggestions are dancing lessons from god.</div>
<div> -- The Books of Bokonon</div>
<div>-------------------------------------------------------------------------------------------------------------------</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
erlang-questions mailing list
<a class="moz-txt-link-abbreviated" href="mailto:erlang-questions@erlang.org">erlang-questions@erlang.org</a>
<a class="moz-txt-link-freetext" href="http://erlang.org/mailman/listinfo/erlang-questions">http://erlang.org/mailman/listinfo/erlang-questions</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Guilherme
<a class="moz-txt-link-freetext" href="https://www.gandrade.net/">https://www.gandrade.net/</a>
PGP: 0x35CB8191 / 1968 5252 3901 B40F ED8A D67A 9330 79B1 35CB 8191
</pre>
</body>
</html>