Zip files, GZip files, and likely others, include information about the contained file, including the uncompressed size of the file. However, when extracting these files the number is meaningless as the actual data can be much larger (eg: reported as 1 byte, but actually 10GB).
Since decompressing a large
.zip file could DoS a system by using up all the resources, you would need some sort of checks in place to prevent extracting a file that could cripple the server. One method would be to limit the allowed size to X GB. If the stated size of a file is greater than that, exit early. However, if the size is stated wrong, you'd need to decompress up to that size before exiting.
A potential alternative is to start decompressing, and as soon as the actual size is larger than the stated (perhaps with a margin of error), exit.
Are there any legitimate cases where the stated size of a compressed file in an archive (zip, gzip, or others) would be wrong? Is there any popular software that produces such broken files?