# HG changeset patch
# User Sebastien Jodogne <s.jodogne@gmail.com>
# Date 1774249526 -3600
# Node ID f2b978accde275bc6335621582a226228ae08289
# Parent  14eabda1f71843e7bc3cd4e45fdc4eb629a416c4
use option "MaximumFileSizeInArchiveMB" for gzip decompression

diff -r 14eabda1f718 -r f2b978accde2 NEWS
--- a/NEWS	Mon Mar 23 07:54:13 2026 +0100
+++ b/NEWS	Mon Mar 23 08:05:26 2026 +0100
@@ -4,7 +4,8 @@
 General
 -------
 
-* New configuration option "MaximumRequestBodySizeMB" to limit the maximum body size in HTTP requests
+* New configuration option "MaximumRequestBodySizeMB" to limit the body size in HTTP requests
+* New configuration option "MaximumFileSizeInArchiveMB" to limit the file size in ZIP/gzip archives
 * New experimental configuration "PatientLevelEnabled" (TODO: work in progree)
 
 REST API
diff -r 14eabda1f718 -r f2b978accde2 OrthancFramework/Sources/Compression/GzipCompressor.cpp
--- a/OrthancFramework/Sources/Compression/GzipCompressor.cpp	Mon Mar 23 07:54:13 2026 +0100
+++ b/OrthancFramework/Sources/Compression/GzipCompressor.cpp	Mon Mar 23 08:05:26 2026 +0100
@@ -30,8 +30,15 @@
 #include <zlib.h>
 
 #include "../ChunkedBuffer.h"
+#include "../Logging.h"
+#include "../MultiThreading/ReaderWriterLock.h"
 #include "../OrthancException.h"
-#include "../Logging.h"
+
+
+static Orthanc::ReaderWriterLock maximumUncompressedFileSizeMutex_;
+static bool hasMaximumUncompressedFileSize_ = false;
+static size_t maximumUncompressedFileSize_ = 0;
+
 
 namespace Orthanc
 {
@@ -224,7 +231,13 @@
     }
     else
     {
-      // TODO
+      ReaderWriterLock::ReadLock lock(maximumUncompressedFileSizeMutex_);
+
+      if (hasMaximumUncompressedFileSize_)
+      {
+        hasMaximumSize = true;
+        maximumSize = maximumUncompressedFileSize_;
+      }
     }
 
     z_stream stream;
@@ -302,4 +315,19 @@
 
     buffer.Flatten(uncompressed);
   }
+
+
+  void GzipCompressor::SetMaximumUncompressedFileSize(uint64_t size)
+  {
+    if (static_cast<uint64_t>(static_cast<size_t>(size)) != size)
+    {
+      throw OrthancException(ErrorCode_NotEnoughMemory);
+    }
+    else
+    {
+      ReaderWriterLock::WriteLock lock(maximumUncompressedFileSizeMutex_);
+      hasMaximumUncompressedFileSize_ = true;
+      maximumUncompressedFileSize_ = size;
+    }
+  }
 }
diff -r 14eabda1f718 -r f2b978accde2 OrthancFramework/Sources/Compression/GzipCompressor.h
--- a/OrthancFramework/Sources/Compression/GzipCompressor.h	Mon Mar 23 07:54:13 2026 +0100
+++ b/OrthancFramework/Sources/Compression/GzipCompressor.h	Mon Mar 23 08:05:26 2026 +0100
@@ -45,5 +45,7 @@
     virtual void Uncompress(std::string& uncompressed,
                             const void* compressed,
                             size_t compressedSize) ORTHANC_OVERRIDE;
+
+    static void SetMaximumUncompressedFileSize(uint64_t size);
   };
 }
diff -r 14eabda1f718 -r f2b978accde2 OrthancFramework/Sources/Compression/ZipReader.cpp
--- a/OrthancFramework/Sources/Compression/ZipReader.cpp	Mon Mar 23 07:54:13 2026 +0100
+++ b/OrthancFramework/Sources/Compression/ZipReader.cpp	Mon Mar 23 08:05:26 2026 +0100
@@ -68,7 +68,7 @@
 #include <string.h>
 
 
-static Orthanc::ReaderWriterLock mutex_;
+static Orthanc::ReaderWriterLock maximumUncompressedFileSizeMutex_;
 static bool hasMaximumUncompressedFileSize_ = false;
 static size_t maximumUncompressedFileSize_ = 0;
 
@@ -419,7 +419,7 @@
 
       {
         // Prevent ZIP bombs
-        ReaderWriterLock::ReadLock lock(mutex_);
+        ReaderWriterLock::ReadLock lock(maximumUncompressedFileSizeMutex_);
 
         if (hasMaximumUncompressedFileSize_ &&
             info.uncompressed_size > maximumUncompressedFileSize_)
@@ -535,7 +535,7 @@
     }
     else
     {
-      ReaderWriterLock::WriteLock lock(mutex_);
+      ReaderWriterLock::WriteLock lock(maximumUncompressedFileSizeMutex_);
       hasMaximumUncompressedFileSize_ = true;
       maximumUncompressedFileSize_ = size;
     }
diff -r 14eabda1f718 -r f2b978accde2 OrthancServer/Sources/main.cpp
--- a/OrthancServer/Sources/main.cpp	Mon Mar 23 07:54:13 2026 +0100
+++ b/OrthancServer/Sources/main.cpp	Mon Mar 23 08:05:26 2026 +0100
@@ -25,6 +25,7 @@
 #include "OrthancRestApi/OrthancRestApi.h"
 
 #include "../../OrthancFramework/Sources/Compatibility.h"
+#include "../../OrthancFramework/Sources/Compression/GzipCompressor.h"
 #include "../../OrthancFramework/Sources/Compression/ZipReader.h"
 #include "../../OrthancFramework/Sources/DicomFormat/DicomArray.h"
 #include "../../OrthancFramework/Sources/DicomNetworking/DicomAssociationParameters.h"
@@ -1146,6 +1147,8 @@
         LOG(WARNING) << "Limiting on the maximum file size uncompressed from ZIP/gzip archives to " << maxSizeInArchive << "MB";
         ZipReader::SetMaximumUncompressedFileSize(static_cast<uint64_t>(maxSizeInArchive) *
                                                   static_cast<uint64_t>(1024 * 1024));
+        GzipCompressor::SetMaximumUncompressedFileSize(static_cast<uint64_t>(maxSizeInArchive) *
+                                                       static_cast<uint64_t>(1024 * 1024));
       }
       else
       {