Adm-zip: GetDataAsync() Bypasses The MaxOutputLength Size Guard Enforced By The Synchronous GetData() Path

Summary adm-zip enforces a "maxOutputLength" guard against decompression bombs on its synchronous "getData" path, but the equivalent asynchronous "getDataAsync" path does not enforce it — it accumulates and returns the entire decompressed output regardless of the entry's declared size. An...