-let mut buffer: Vec<u8> = Vec::new();
-xz_decoder.read_to_end(&mut buffer)?;
+let mut buffer: Vec<u8> = Vec::with_capacity(10 * 1024 * 1024); // 10MB initial capacity
+if xz_decoder.read_to_end(&mut buffer)? > 100 * 1024 * 1024 { // 100MB limit
+    return Err(Error::msg("XZ file too large"));
+}

-if !target.exists() {
-    for entry in archive.entries()? {
-        let mut entry_decoder = entry?;
-        let entry_path: PathBuf = entry_decoder.path()?.iter().skip(1).collect();
-        let entry_target = target.join(entry_path);
-        fs::create_dir_all(entry_target.parent().unwrap())?;
-        entry_decoder.unpack(entry_target)?;
+fs::create_dir_all(target)?;
+for entry in archive.entries()? {
+    let mut entry_decoder = entry?;
+    let entry_path: PathBuf = entry_decoder.path()?.iter().skip(1).collect();
+    let entry_target = target.join(entry_path);
+    if let Some(parent) = entry_target.parent() {
+        fs::create_dir_all(parent)?;
     }
+    entry_decoder.unpack(entry_target)?;
 }