Stopping zipbombs with Sophie

Martin Zuziak <[email protected]> Fri, 31 Dec 2004 14:20:18 +0100
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
Hi

I'm trying to set a limit on the disk space used by Sophie while
decompressing files. I don't want a 1 Megabyte zipped file being
decompressed to 1 Gigabyte of zeros. Is there some way to do this?

I've seen the limit_decompr parameter. It seems to limit the number of
times the function CISaviNotify_OkToContinue may be called with scanning
activity set to SOPHOS_ACTVTY_DECOMPR. But wouldn't it be more useful to
count the data volume decompressed as given in the Extent argument?

Thanks,

Martin Zuziak <[email protected]>