valyala/fasthttp · error

too much data gunzipped: %d

Error message

too much data gunzipped: %d

What it means

WriteGunzip decompresses gzip data into a writer using a bounded zero-alloc copy. If the decompressed output exceeds maxBodySize so the total cannot fit in an int, it returns 'too much data gunzipped' rather than silently truncating — a guard against decompression bombs.

Source

Thrown at compress.go:228

}

// WriteGunzip writes ungzipped p to w and returns the number of uncompressed
// bytes written to w.
func WriteGunzip(w io.Writer, p []byte) (int, error) {
	return writeGunzip(w, p, 0)
}

func writeGunzip(w io.Writer, p []byte, maxBodySize int) (int, error) {
	r := &byteSliceReader{b: p}
	zr, err := acquireGzipReader(r)
	if err != nil {
		return 0, err
	}
	n, err := copyZeroAllocWithLimit(w, zr, maxBodySize)
	releaseGzipReader(zr)
	nn := int(n)
	if int64(nn) != n {
		return 0, fmt.Errorf("too much data gunzipped: %d", n)
	}
	return nn, err
}

// AppendGunzipBytes appends gunzipped src to dst and returns the resulting dst.
func AppendGunzipBytes(dst, src []byte) ([]byte, error) {
	w := &byteSliceWriter{b: dst}
	_, err := WriteGunzip(w, src)
	return w.b, err
}

// AppendDeflateBytesLevel appends deflated src to dst using the given
// compression level and returns the resulting dst.
//
// Supported compression levels are:
//
//   - CompressNoCompression
//   - CompressBestSpeed

View on GitHub (pinned to c96f600972)

Solutions

1. Stream the data with gzip.NewReader(io.LimitReader(...)) instead of one-shot decompression
2. Enforce a size limit on the compressed input before decompressing
3. Reject or truncate payloads whose declared decompressed size is too large
4. Use io.Copy to a file rather than an in-memory buffer for large data

Example fix

// before
err := fasthttp.WriteGunzip(buf, hugeGzippedBody)
// after
zr, err := gzip.NewReader(bytes.NewReader(hugeGzippedBody))
if err != nil { return err }
_, err = io.Copy(io.Discard, io.LimitReader(zr, maxDecompressed)) // bounded streaming

if len(gzipped) > maxCompressedInput { return errors.New("compressed payload too large") }

if err := fasthttp.WriteGunzip(buf, body); err != nil {
    if strings.Contains(err.Error(), "too much data gunzipped") {
        // stream to disk instead of memory
    }
}

When it happens

Trigger: Calling fasthttp.WriteGunzip (or AppendGunzipBytes/gunzipData) with gzip input whose uncompressed size exceeds the library's maxBodySize limit.

Common situations: Processing user-supplied gzip payloads (a zip bomb), decompressing huge log archives into memory, proxying compressed responses without size limits.

Related errors

• too much data inflated: %d
• must implement readat
• directory index required
• no 'create file' permissions
• seek is not implemented

AI-assisted analysis of valyala/fasthttp@c96f600972 (2026-08-31). Data as JSON: /api/errors/c1732fbb79b64794. Report an issue: GitHub.