Everyone&#x27;s focusing on this being a PNG problem but actually if my server unzips a 420 byte file into a 5M file of any kind, I&#x27;d say that&#x27;s the first red flag. Assuming some sort of streaming decompression, you could write an output filter that shuts off the decompressor when it&#x27;s seen a factor of X bytes. A reasonable factor would be 10 - which in this case would have halted bzip decompression at 4kB.<p>This would probably be a trivial patch to bzip2. But I like the idea in general of passing an &quot;max input&#x2F;output ratio&quot; to any process or function that might yield far more output than input.