The codecs in pyiceberg/avro/codecs/ decompress without bounding the output — e.g. bz2.decompress(data) in bzip2.py, and the same shape in the deflate and zstd paths.
The compressed input determines the decompressed size, and no cap or expansion-ratio check is applied.
Issue investigation generated via claude, reviewed by Sung, Kevin, Fokko.
The codecs in
pyiceberg/avro/codecs/decompress without bounding the output — e.g.bz2.decompress(data)inbzip2.py, and the same shape in the deflate and zstd paths.The compressed input determines the decompressed size, and no cap or expansion-ratio check is applied.
Issue investigation generated via claude, reviewed by Sung, Kevin, Fokko.