Compression bomb
A compression bomb is a small archive that unpacks to a huge size.
Why does it matter?
Unpacking it fills memory or disk. This is CWE-409.
What does preslice check?
How many times each file inside the archive expands, and the archive as a
whole. Each file declares its own sizes, so preslice reads them before it
unpacks anything. A real .3mf expands about 5 to 16 times. A file that
expands past its declared size is stopped there.
What are the limits?
| Condition | Result |
|---|---|
| One file over 100 times and over 64 MB | Fail, and that file is never unpacked |
| The whole archive over 100 times and over 64 MB | Fail |
| Over 100 times, under 64 MB | Warn |
| Over 40 times | Warn |
| Otherwise | Pass |
A file preslice refused to unpack shows as Not read, amplified on the other
checks. If it is the model itself, 3D/3dmodel.model, the file does not open
at all.
Which apps did it work on?
ideaMaker and MeshMagic failed on compression bombs in the 2023 study Security Analysis of the 3MF Data Format (RAID 2023).
Are current slicers exposed?
No public case is known. Bambu Studio, OrcaSlicer and PrusaSlicer unpack each
member into memory with miniz, sized by the archive's own figure
(bbs_3mf.cpp).
Cura uses Python's zipfile
(ThreeMFReader.py).
What do I do when the check fails?
Do not open the file in a slicer or unpack it. A real .3mf never expands
hundreds of times. Delete it and tell whoever shared it. A warning on a file
that carries sliced G-code can be honest, since G-code repeats and packs
tightly; get the file again from its source if you are unsure.