Function decompress_bounded 

pub fn decompress_bounded(
    stream: &[u8],
    max_len: u64,
) -> Result<Vec<u8>, DecompressError>

RNS 1.4.2’s bounded bz2 inflate, BZ2Decompressor(...).decompress(data, max_length=…) with the eof check: inflate to at most max_len, refusing a stream that would run past it. Both callers cap max_len at host policy (a resource’s advertised length, already gated by the link’s ResourceStrategy; a stream chunk’s channel MDU), so a bz2 bomb can force neither an unbounded allocation nor an unbounded inflate. A resource caller passes its exact advertised length and re-checks it on assembly, so a stream that inflates short is caught there.