AVRO-4247: Enforce decompression size limits - #3745

Merged

RyanSkraba merged 13 commits into

apache:mainfrom

steveloughran:pr/java-codec-decompression

May 11, 2026

Commits on Jan 14, 2026

[AVRO-4081] Add decompression size limit to prevent decompression bomb DoS
OwenSanzas
committed
50a6bfc
Update lang/java/avro/src/main/java/org/apache/avro/file/DeflateCodec.java

OwenSanzas
and
martin-g
authored
13edbf8
Update lang/java/avro/src/main/java/org/apache/avro/file/DeflateCodec.java

OwenSanzas
and
martin-g
authored
406bf50
Address code review feedback for decompression bomb fix
OwenSanzas
committed
fd85f2e

Commits on Apr 28, 2026

Merge branch 'main' into pr/java-codec-decompression
Steve Loughran
committed
a406f72
[AVRO-4] Move limit checks into NonCopyingByteArrayOutputStream
Steve Loughran
committed
87b7126

Commits on Apr 30, 2026

[AVRO-4247] review feedback
Steve Loughran
committed
a0bc310

Commits on May 1, 2026

[AVRO-4247] Rework invocation
Steve Loughran
committed
c1b35a7

Commits on May 5, 2026

spotless
Steve Loughran
committed
5f0b517
getLongLimitFromProperty() to use parameters over inline constants
Steve Loughran
committed
f481b5a

Commits on May 6, 2026

change static factory method to "capacityLimitedOutputStream()"
Steve Loughran
committed
adaf226

Commits on May 8, 2026

Apply compressor changes from iemejia
Steve Loughran
committed
82b04ec

Commits on May 10, 2026

Beautify with spotless
RyanSkraba
authored
83dc17b