hub.darcs.net :: vmchale -> bz2 -> issue

jchia

The documentation is not crystal clear on the source of the insecurity of the Codec.Compression.BZip.decompress function. Is it because the underlying C library is insecure in its treatment of pathological input or is it because the bz2 package uses the C library wrongly? Or, is it because of theoretical concerns like the use of unsafeIOToST? Or, is the documentation just trying to express a warning about undiscovered vulns in the underlying C library?

More importantly, as a user I can't tell whether I should be more concerned about getting pwned when using this library than when using the underlying C library directly or the bunzip2 command.

Can this part of the documentation be made clearer? At face value, it sounds like a warning to just not use the decompress function at all because typically users can't tell whether the input is pathological.