Decompression bomb vulnerability

[markmnl]

Currently the specification for zlib-deflate allows a small compressed zlib payload that passes MAX_SIZE, and user quotas but expands to a huge amount during hashing, storage and quota checks.