Maliciously constructed replay files can cause very high memory usage

[tec27]

Replay files that have one of the variable length sections (e.g. commands) replaced with malicious "decompression bomb"-type payloads can cause issues since screp decompresses the full thing eagerly. I have a 10MB replay file that causes screp to get to ~40GB of RAM usage while processing it. For local usage, this is probably not that big of a deal, but on servers this seems like a problem. SC:R also seems to refuse to load this file quite early without much work, unsure if they have a hard limit on filesizes or they parse commands as they decompress and bail out on seeing the invalid commands (although given that the error is "This replay is for a StarCraft expansion" I would guess it's probably the latter).

Happy to send you my replay file if that helps, although it would probably be best to do it outside of GitHub issues since it makes this pretty easy to exploit, just let me know!

[icza]

Hey tec27, thanks for reporting this. I'll look into it, you can share the example rep in discord.