Protection against zip bombs

[casey]

Can untrusted inputs be decompressed without using unbounded memory?

[danielrh]

You can employ 2 tactics:
a) You can specify a custom allocator that will not return inputs beyond a certain size.
b) You can instantiate a reader and choose to only read a certain number of bytes from the input and bound the resource usage that way.

I believe it should not use more than a fixed size based on the window size, but you can ensure that using (a)
And since the reader or writer interfaces only use bounded buffers you can either stop when your output is full or keep streaming it.