fix: bound control-stream decompressor output against input size by minagishl · Pull Request #21 · twilic/twilic-rust

minagishl · 2026-06-29T09:44:53Z

Summary

Add DEFAULT_MAX_DECODE_OUTPUT_RATIO (1024) and check_decode_output_bytes so decompressors reject cumulative output larger than input_len * ratio (capped by DEFAULT_MAX_DECODE_COUNT)
Apply output-budget checks to control-stream RLE, Huffman, and FSE decoders, plus vector RLE (decode_u64_rle / decode_i64_rle)
Add regression tests for crafted decompression-bomb payloads across all three codecs

Related Issue

Closes #2

Type of Change

Testing

cargo test — all 75 tests pass
cargo fmt --all
cargo clippy --all-targets --all-features
Added tests: control_stream_rle_rejects_decompression_bomb, control_stream_huffman_rejects_decompression_bomb, control_stream_fse_rejects_decompression_bomb, wire_extend_repeat_rejects_output_ratio_bomb

Checklist

Tests added or updated (optional)
Documentation updated (if applicable)
No breaking changes (or breaking changes are documented above)

Note

Medium Risk
Security-focused decode hardening across multiple decompressors; behavior change rejects previously accepted malicious inputs but should not affect valid payloads within the ratio cap.

Overview
Adds output-ratio limits on decode paths so tiny compressed payloads cannot expand into huge in-memory buffers (decompression bombs).

Wire layer: Introduces DEFAULT_MAX_DECODE_OUTPUT_RATIO (1024), max_decode_output_bytes, check_decode_output_bytes, and extend_repeat_with_budget, which rejects cumulative output above input_len × ratio (capped by DEFAULT_MAX_DECODE_COUNT). extend_repeat now delegates to the budgeted helper.

Decoders: Vector RLE (decode_u64_rle / decode_i64_rle) parses runs first, then expands using only bytes consumed for the RLE header as the budget—not the full column buffer. Control-stream RLE, Huffman, and FSE apply the same checks; Huffman/FSE also pre-check declared output length and cap Vec capacity.

API: Re-exports DEFAULT_MAX_DECODE_OUTPUT_RATIO from the crate root.

Tests: Regression coverage for ratio bombs on wire helpers, vector RLE (including trailing junk bytes), and control-stream RLE/Huffman/FSE via TwilicCodec.

^{Reviewed by Cursor Bugbot for commit 0a5c455. Bugbot is set up for automated code reviews on this repo. Configure here.}

github-actions · 2026-06-29T09:45:04Z

Invisible characters check

No suspicious invisible characters detected in the PR diff.

cursor

Stale comment

Risk: medium. Not approving: Cursor Bugbot completed with a skipped/neutral check and reported 1 unresolved finding (vector RLE output-ratio budget uses trailing bytes). Human review is needed before merge; no additional reviewers were assigned because the PR author is the sole repository collaborator.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

cursor

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 30fb134. Configure here.}

cursor

Stale comment

Risk: medium. Not approving: Cursor Bugbot check skipped and reported 1 unresolved finding (control-stream RLE output-ratio budget uses full input slice length). Human review is needed before merge; no additional reviewers were assigned because the PR author is the sole repository collaborator.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

Co-authored-by: minagishl <minagishl@users.noreply.github.com>

cursor

Risk: medium. Not approving: Cursor Bugbot check passed on the latest commit but no corresponding Bugbot review comment was found for HEAD. Human review is needed before merge; no additional reviewers were assigned because the PR author is the sole repository collaborator.

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

fix: bound control-stream decompressor output against input size

1931715