Refuse to encode payloads above the framed file cap - #1697
Conversation
Decode already drops compressed frames whose declared originalSize exceeds FileTransferLimits.maxFramedFileBytes. Encode only checked the wire length-field width, so v2 could emit frames every honest peer (including ourselves) silently rejects. Mirror the decode ceiling on encode and update the oversized-payload test.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: db187711ca
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| // Decode enforces FileTransferLimits.maxFramedFileBytes; encode previously only checked | ||
| // the on-wire length field width, so v2 could compress up to UInt32.max and produce | ||
| // frames peers (including ourselves) silently drop. | ||
| guard payload.count <= FileTransferLimits.maxFramedFileBytes else { return nil } |
There was a problem hiding this comment.
For a v2 payload at (or within three bytes of) maxFramedFileBytes that is only slightly compressible, this guard passes based on the original size, but encoding then adds the 4-byte original-size preamble. payloadDataSize can therefore exceed the decoder's framed cap even though the source payload did not, and decodeCore will reject the emitted frame before decompression. Validate payloadDataSize against maxFramedFileBytes after compression as well.
Useful? React with 👍 / 👎.
1 participant
Summary
BinaryProtocol.encodeonly checked that a compressed size fit in the v1/v2 length field (UInt16/UInt32), so it could emit frames whose declaredoriginalSizeexceedsFileTransferLimits.maxFramedFileBytes.Test plan
BinaryProtocolTestsoversized + framed-cap round-tripnilformaxFramedFileBytes + 1Refs #1618 #1629