OctoRPKI crashes when processing GZIP bomb returned via malicious repository

@@ -442,7 +442,8 @@ func (s *state) MainRRDP(pSpan opentracing.Span) {
 				sentry.CaptureException(err)
 			})
 
-			if s.RRDPFailover {
+			// GHSA-g9wh-3vrx-r7hg: Do not process responses that are too large
+			if s.RRDPFailover && err.Error() != "http: request body too large" {
 				log.Errorf("Error when processing %v (for %v): %v. Will add to rsync.", path, rsync, err)
 				rSpan.LogKV("event", "rrdp failure", "type", "failover to rsync", "message", err)
 			} else {

@@ -6,12 +6,15 @@ import (
 	"encoding/xml"
 	"errors"
 	"fmt"
-	"github.com/getsentry/sentry-go"
 	"io/ioutil"
 	"net/http"
 	"strings"
+
+	"github.com/getsentry/sentry-go"
 )
 
+const ResponseLimit int64 = 100000000 // (100mb)
+
 type RRDPFetcher interface {
 	GetXML(string) (string, error)
 }
@@ -40,7 +43,10 @@ func (f *HTTPFetcher) GetXML(url string) (string, error) {
 		return "", NewRRDPErrorFetch(req, errors.New(fmt.Sprintf("status is %d", res.StatusCode)))
 	}
 
-	data, err := ioutil.ReadAll(res.Body)
+	// GHSA-g9wh-3vrx-r7hg: Do not process responses that are excessively large
+	r := http.MaxBytesReader(nil, res.Body, ResponseLimit)
+	data, err := ioutil.ReadAll(r)
+
 	if err != nil {
 		return "", err
 	}