fix: KMZ zip bomb mitigation by adding entry and size limits

library/src/main/java/com/google/maps/android/data/kml/KmlLayer.java

@@ -46,6 +46,9 @@
  */
 public class KmlLayer extends Layer {
 
+    private static final int MAX_KMZ_ENTRY_COUNT = 200;
+    private static final long MAX_KMZ_UNCOMPRESSED_TOTAL_SIZE = 50 * 1024 * 1024; // 50MB
+
     /**
      * Creates a new KmlLayer object - addLayerToMap() must be called to trigger rendering onto a map.
      *
@@ -145,16 +148,22 @@ public KmlLayer(GoogleMap map,
         BufferedInputStream bis = new BufferedInputStream(stream);
         bis.mark(1024);
         ZipInputStream zip = new ZipInputStream(bis);
+        CountingInputStream countingStream = new CountingInputStream(zip, MAX_KMZ_UNCOMPRESSED_TOTAL_SIZE);
         try {
             KmlParser parser = null;
             ZipEntry entry = zip.getNextEntry();
             if (entry != null) { // is a KMZ zip file
+                int entryCount = 0;
                 HashMap<String, Bitmap> images = new HashMap<>();
                 while (entry != null) {
+                    entryCount++;
+                    if (entryCount > MAX_KMZ_ENTRY_COUNT) {
+                        throw new IOException("Zip bomb detected! Max number of entries exceeded: " + MAX_KMZ_ENTRY_COUNT);
+                    }
                     if (parser == null && entry.getName().toLowerCase().endsWith(".kml")) {
-                        parser = parseKml(zip);
+                        parser = parseKml(countingStream);
                     } else {
-                        Bitmap bitmap = BitmapFactory.decodeStream(zip);
+                        Bitmap bitmap = BitmapFactory.decodeStream(countingStream);
                         if (bitmap != null) {
                             images.put(entry.getName(), bitmap);
                         } else {
@@ -182,6 +191,57 @@ public KmlLayer(GoogleMap map,
         }
     }
 
+    /**
+     * Wrapper for an InputStream that counts the number of bytes read and throws an IOException
+     * if the limit is exceeded.
+     */
+    private static class CountingInputStream extends InputStream {
+        private final InputStream mIn;
+        private long mTotalBytes = 0;
+        private final long mMaxBytes;
+
+        public CountingInputStream(InputStream in, long maxBytes) {
+            mIn = in;
+            mMaxBytes = maxBytes;
+        }
+
+        @Override
+        public int read() throws IOException {
+            int b = mIn.read();
+            if (b != -1) {
+                mTotalBytes++;
+                checkLimit();
+            }
+            return b;
+        }
+
+        @Override
+        public int read(byte[] b, int off, int len) throws IOException {
+            int n = mIn.read(b, off, len);
+            if (n != -1) {
+                mTotalBytes += n;
+                checkLimit();
+            }
+            return n;
+        }
+
+        @Override
+        public long skip(long n) throws IOException {
+            long skipped = mIn.skip(n);
+            if (skipped > 0) {
+                mTotalBytes += skipped;
+                checkLimit();
+            }
+            return skipped;
+        }
+
+        private void checkLimit() throws IOException {
+            if (mTotalBytes > mMaxBytes) {
+                throw new IOException("Zip bomb detected! Uncompressed size exceeds limit of " + mMaxBytes + " bytes.");
+            }
+        }
+    }
+
     private static KmlParser parseKml(InputStream stream) throws XmlPullParserException, IOException {
         XmlPullParser xmlPullParser = createXmlParser(stream);
         KmlParser parser = new KmlParser(xmlPullParser);

library/src/test/java/com/google/maps/android/data/kml/KmlZipBombTest.java

@@ -0,0 +1,92 @@
+/*
+ * Copyright 2026 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.google.maps.android.data.kml;
+
+import android.content.Context;
+import androidx.test.core.app.ApplicationProvider;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.robolectric.RobolectricTestRunner;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipOutputStream;
+
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.fail;
+
+@RunWith(RobolectricTestRunner.class)
+public class KmlZipBombTest {
+
+    @Test
+    public void testValidKmz() throws Exception {
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        ZipOutputStream zos = new ZipOutputStream(baos);
+        zos.putNextEntry(new ZipEntry("doc.kml"));
+        zos.write("<kml xmlns=\"http://www.opengis.net/kml/2.2\"><Document></Document></kml>".getBytes());
+        zos.closeEntry();
+        zos.close();
+
+        Context context = ApplicationProvider.getApplicationContext();
+        KmlLayer layer = new KmlLayer(null, new ByteArrayInputStream(baos.toByteArray()), context);
+        assertNotNull(layer);
+    }
+
+    @Test
+    public void testMaxEntriesLimit() throws Exception {
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        ZipOutputStream zos = new ZipOutputStream(baos);
+        for (int i = 0; i < 202; i++) {
+            zos.putNextEntry(new ZipEntry("entry" + i + ".txt"));
+            zos.write("data".getBytes());
+            zos.closeEntry();
+        }
+        zos.close();
+
+        Context context = ApplicationProvider.getApplicationContext();
+        try {
+            new KmlLayer(null, new ByteArrayInputStream(baos.toByteArray()), context);
+            fail("Should have thrown IOException due to too many entries");
+        } catch (IOException e) {
+            // Expected
+        }
+    }
+
+    @Test
+    public void testMaxSizeLimit() throws Exception {
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        ZipOutputStream zos = new ZipOutputStream(baos);
+        zos.putNextEntry(new ZipEntry("large_entry.kml"));
+        // 50MB + 1 byte
+        byte[] largeData = new byte[1024 * 1024];
+        for (int i = 0; i < 51; i++) {
+            zos.write(largeData);
+        }
+        zos.closeEntry();
+        zos.close();
+
+        Context context = ApplicationProvider.getApplicationContext();
+        try {
+            new KmlLayer(null, new ByteArrayInputStream(baos.toByteArray()), context);
+            fail("Should have thrown IOException due to size limit");
+        } catch (IOException e) {
+            // Expected
+        }
+    }
+}