Function decode_with_limit

atomic-objects/src/sync.rs:313–319

Decompress and deserialize a wire body, refusing to inflate past `max_len` bytes. The bound is enforced during decompression (streaming), so a zip bomb is stopped before it is fully materialized.

(
    bytes: &[u8],
    max_len: usize,
)

/// bytes. The bound is enforced during decompression (streaming), so a zip bomb
/// is stopped before it is fully materialized.
pub fn decode_with_limit<T: DeserializeOwned>(
    bytes: &[u8],
    max_len: usize,
) -> Result<T, SyncError> {
    let raw = decompress(bytes, max_len)?;
    postcard::from_bytes(&raw).map_err(SyncError::Codec)
}

/// Streaming zstd decompress with a hard output ceiling. Reads at most
/// `max_len + 1` bytes so an overrun is detected without buffering the whole