mirror of
https://github.com/storytold/craft-libs.git
synced 2026-11-14 22:42:46 +00:00
An archive could hold many individually allowed members whose combined decompression was unbounded, because both readers passed max_total_bytes: u64::MAX to craft-zip. Each now passes MAX_TOTAL (4 GiB) and every entry read is charged to it. craft-fig's declared-entry cap drops from 1,000,000 to 100,000 to match the other ZIP readers; its images were already bounded by Limits::max_image_total.