rpc_util: limit decompression size in legacy gzipDecompressor to prevent OOM

[evilgensec]

Summary

The legacy gzipDecompressor.Do() (used when a server is configured with the deprecated grpc.RPCDecompressor(grpc.NewGZIPDecompressor()) option) calls io.ReadAll(z) with no size bound. The size limit check happens after the full payload is materialized in memory:

// decompress():
uncompressed, err := dc.Do(r)          // io.ReadAll — full payload in memory
...
if len(uncompressed) > maxReceiveMessageSize {   // too late

A client can send a highly compressed gRPC frame (e.g., 1 KiB of gzip expanding to 1+ GiB) and force the server to buffer the entire expanded payload before the MaxRecvMsgSize limit fires.

The modern encoding.Compressor path already uses io.LimitReader(dcReader, limit+1) to prevent this (lines 993–1010). The deprecated path did not have the equivalent guard.

Fix

Wrap the reader passed to dc.Do with io.LimitReader(maxReceiveMessageSize+1), matching the behavior of the safe code path.

Scope

Only affects servers explicitly configured with grpc.RPCDecompressor(grpc.NewGZIPDecompressor()). The default server uses the encoding.Compressor path and is unaffected.

RELEASE NOTES:

• TBD

[Copilot]

Pull request overview

This PR hardens the deprecated grpc.Decompressor (legacy gzipDecompressor.Do() / grpc.RPCDecompressor(grpc.NewGZIPDecompressor())) receive path against decompression bombs by ensuring decompression cannot expand unbounded in memory before MaxRecvMsgSize is enforced.

Changes:

• Wrap the legacy decompressor input reader with io.LimitReader(maxReceiveMessageSize+1) to bound decompression output prior to the post-decompression size check.
• Add explanatory comments documenting the OOM risk and rationale for the limit.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.02%. Comparing base (3d0dd1e) to head (ee97a0a).
⚠️ Report is 4 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #9114      +/-   ##
==========================================
- Coverage   83.06%   83.02%   -0.04%     
==========================================
  Files         413      413              
  Lines       33487    33485       -2     
==========================================
- Hits        27816    27802      -14     
- Misses       4245     4251       +6     
- Partials     1426     1432       +6     

Files with missing lines	Coverage Δ
rpc_util.go	83.11% <100.00%> (+0.13%)	⬆️

... and 25 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[easwars]

The legacy gzip compressor has been deprecated for over 8 years. So, while this fix is valid, it probably doesn't represent any real security vulnerability, because there is hardly going to be anyone using this.

[easwars]

@arjan-bal for second set of eyes