1 files changed, 11 insertions, 0 deletions
diff --git a/common/iobuf.c b/common/iobuf.c
index 1a84f3f41..ae9bfa94d 100644
--- a/common/iobuf.c
+++ b/common/iobuf.c
@@ -55,6 +55,10 @@
    be aware that there is no fsync support for the stdio backend.  */
 #undef FILE_FILTER_USES_STDIO
 
+/* To avoid a potential DoS with compression packets we better limit
+   the number of filters in a chain.  */
+#define MAX_NESTING_FILTER 64
+
 /*-- End configurable part.  --*/
 
 
@@ -1615,6 +1619,13 @@ iobuf_push_filter2 (iobuf_t a,
 
   if (a->use == 2 && (rc = iobuf_flush (a)))
     return rc;
+
+  if (a->subno >= MAX_NESTING_FILTER)
+    {
+      log_error ("i/o filter too deeply nested - corrupted data?\n");
+      return GPG_ERR_BAD_DATA;
+    }
+
   /* make a copy of the current stream, so that
    * A is the new stream and B the original one.
    * The contents of the buffers are transferred to the