@velvia No, the securecoding.cert.org doc says that checking the size before is _NOT_ sufficient because the size field can just be forged... that code is the "incorrect solution" section.  It may seem silly, but you have a customer doing a "security check" of us and we have an API that allows a zip upload... that is a pretty obvious test to try.  Although obviously the DoS attack is much less serious than if a directory traversal was possible.