{"record":{"id":"629cae6a1460dac1","repo":"valyala/fasthttp","slug":"too-much-data-inflated-d","errorCode":null,"errorMessage":"too much data inflated: %d","messagePattern":"too much data inflated: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"compress.go","lineNumber":341,"sourceCode":"}\n\n// WriteInflate writes inflated p to w and returns the number of uncompressed\n// bytes written to w.\nfunc WriteInflate(w io.Writer, p []byte) (int, error) {\n\treturn writeInflate(w, p, 0)\n}\n\nfunc writeInflate(w io.Writer, p []byte, maxBodySize int) (int, error) {\n\tr := &byteSliceReader{b: p}\n\tzr, err := acquireFlateReader(r)\n\tif err != nil {\n\t\treturn 0, err\n\t}\n\tn, err := copyZeroAllocWithLimit(w, zr, maxBodySize)\n\treleaseFlateReader(zr)\n\tnn := int(n)\n\tif int64(nn) != n {\n\t\treturn 0, fmt.Errorf(\"too much data inflated: %d\", n)\n\t}\n\treturn nn, err\n}\n\n// AppendInflateBytes appends inflated src to dst and returns the resulting dst.\nfunc AppendInflateBytes(dst, src []byte) ([]byte, error) {\n\tw := &byteSliceWriter{b: dst}\n\t_, err := WriteInflate(w, src)\n\treturn w.b, err\n}\n\ntype byteSliceWriter struct {\n\tb []byte\n}\n\nfunc (w *byteSliceWriter) Write(p []byte) (int, error) {\n\tw.b = append(w.b, p...)\n\treturn len(p), nil","sourceCodeStart":323,"sourceCodeEnd":359,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/compress.go#L323-L359","documentation":"WriteInflate is the raw-flate counterpart of WriteGunzip: bounded copy + int overflow guard. When inflated output exceeds maxBodySize, the 'too much data inflated' error is returned instead of an integer overflow.","triggerScenarios":"Calling fasthttp.WriteInflate (or AppendInflateBytes/inflateData) with raw DEFLATE data whose decompressed size exceeds maxBodySize.","commonSituations":"Handling HTTP deflate-encoded responses of unusual size, decompressing zlib/deflate blobs from untrusted sources, legacy protocol payloads without size caps.","solutions":["Stream with flate.NewReader plus an io.LimitReader bound","Cap compressed input size before inflating","Verify the expected decompressed size from protocol headers first","Switch to gzip/zlib framing which often carries length metadata (ISIZE) for pre-checks"],"exampleFix":"// before\nerr := fasthttp.WriteInflate(buf, deflatedBody)\n// after\nfr := flate.NewReader(bytes.NewReader(deflatedBody))\n_, err := io.Copy(io.Discard, io.LimitReader(fr, maxDecompressed)) // bounded streaming","handlingStrategy":"validation","validationCode":"if len(deflated) > maxCompressedInput { return errors.New(\"compressed payload too large\") }","typeGuard":null,"tryCatchPattern":"if err := fasthttp.WriteInflate(buf, body); err != nil {\n    if strings.Contains(err.Error(), \"too much data inflated\") {\n        // switch to bounded streaming inflate\n    }\n}","preventionTips":["Cap input size before inflating","Stream with flate.NewReader + io.LimitReader","For untrusted payloads prefer gzip/zlib framing with size headers"],"tags":["go","deflate","decompression","memory-limit"],"backgroundTag":"decompression-bomb","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}