pjfanning opened a new issue, #3674: URL: https://github.com/apache/pekko/issues/3674
luben/zstd-jni#431 (merged 2026-10-22, fixes luben/zstd-jni#430) adds `ZstdDecompressCtx.setLongMax(int windowLogMax)`, which sets `ZSTD_d_windowLogMax` on the decompression context. Pekko's new zstd support (#3639) creates a bare `ZstdDecompressCtx` in `ZstdDecompressor`, with no way to limit the decompression window. libzstd's default maximum window is 2^27 (128 MiB), and the window buffer is allocated from the frame header before any decompressed-size limit applies. A small input can therefore make the decoder allocate up to 128 MiB per stream. This matters for server-side use, e.g. `zstd` content-coding in pekko-http (apache/pekko-http#860), where [RFC 9659](https://www.rfc-editor.org/rfc/rfc9659) caps the window at 8 MB (windowLog 23). Once a zstd-jni release includes #431 (after 1.5.7-24): - bump `zstdJniVersion` in `project/Dependencies.scala` - add a `windowLogMax` parameter (or equivalent) to `ZstdDecompressor` and to `Compression.zstdDecompress` in both the scaladsl and the javadsl, and call `setLongMax` on the context - document the option on the `zstdDecompress` operator page, including the RFC 9659 limit - test that a frame with a larger window is rejected and that one within the limit decodes The zstd API is marked `@ApiMayChange` in #3639, so new parameters can be added without binary compatibility concerns. Optional, related: `ZstdCompressor` / `Compression.zstd` could also expose `ZstdCompressCtx.setWindowLog`, since levels 20-22 use windows larger than RFC 9659 allows on large inputs. Depends on #3639. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
