Add CappedMemoryStream

UnitTests/SecurityVulnerabilitiesTest.cs

@@ -198,7 +198,7 @@ public void DeflateBomb()
 
             // when
             Exception thrownException = Assert.Throws<JoseException>(() => Jose.JWT.Decode(bomb, privateKey));
-            Assert.IsAssignableFrom<NotSupportedException>(thrownException.InnerException);
+            Assert.IsType<NotSupportedException>(thrownException.InnerException);
         }
 
         [Fact]

jose-jwt/compression/DeflateCompression.cs

@@ -28,24 +28,22 @@ public byte[] Compress(byte[] plainText)
 
         public byte[] Decompress(byte[] compressedText)
         {
-            byte[] buffer = new byte[maxBufferSizeBytes];
-
             try
             {
-                using (MemoryStream ms = new MemoryStream(buffer))
+                using (MemoryStream ms = new CappedMemoryStream(maxBufferSizeBytes))
                 {
                     using (MemoryStream compressedStream = new MemoryStream(compressedText))
                     {
                         using (DeflateStream deflater = new DeflateStream(compressedStream, CompressionMode.Decompress))
                         {
                             deflater.CopyTo(ms);
                         }
-                    }
-
-                    return Arrays.Truncate(ms.ToArray(), ms.Position);
+                    }
+
+                    return ms.ToArray();
                 }
             }
-            catch(NotSupportedException e)
+            catch (NotSupportedException e)
             {
                 throw new JoseException("Unable to deflate compressed payload, most likely exceeded decompression buffer size.", e);
             }