Vulnerable code sample

import zlib
import io

# This function simulates the vulnerable decompression logic.
# It represents the behavior of Tornado's HTTP client or server
# when processing a gzipped response or request body.
def vulnerable_decompress(gzipped_payload):
    # This simulates reading the compressed data from a network stream.
    payload_stream = io.BytesIO(gzipped_payload)

    # Initialize the decompressor for gzip format.
    decompressor = zlib.decompressobj(16 + zlib.MAX_WBITS)
    
    # Store decompressed parts in a list.
    decompressed_body_parts = []
    
    # Define a size for reading chunks from the stream. Tornado processed
    # the stream in chunks.
    CHUNK_SIZE = 65536 

    # Loop to decompress the stream chunk by chunk.
    while True:
        compressed_chunk = payload_stream.read(CHUNK_SIZE)
        if not compressed_chunk:
            break
        
        # Decompress the current chunk.
        decompressed_chunk = decompressor.decompress(compressed_chunk)
        decompressed_body_parts.append(decompressed_chunk)
        
        # THE VULNERABILITY:
        # There is no check on the total accumulated size of the data
        # in `decompressed_body_parts`. A malicious payload can make this
        # list grow indefinitely, consuming excessive memory.

    # Finalize decompression.
    remaining = decompressor.flush()
    if remaining:
        decompressed_body_parts.append(remaining)

    # This final operation joins all the parts in memory. If the original
    # payload was a "gzip bomb", this could consume gigabytes of RAM.
    full_body = b"".join(decompressed_body_parts)
    return full_body

# 1. Create a "gzip bomb": a small compressed payload that expands to a large size.
# This simulates a malicious payload from a server or client.
# We compress 10MB of zeros, which compresses very effectively.
original_data = b'\0' * (10 * 1024 * 1024) 
malicious_gzipped_payload = zlib.compress(original_data, level=9)

# 2. Run the vulnerable function.
# This call will allocate a 10MB byte array in memory (`final_decompressed_data`)
# from a much smaller compressed payload, demonstrating the memory exhaustion issue.
final_decompressed_data = vulnerable_decompress(malicious_gzipped_payload)