rsync >= 3.4.3 rejects transfers from another implementation that uses a chunk size of 64k

[jwhitham]

The acrosync implementation of rsync uses a chunk size of 64k - see https://github.com/gilbertchen/acrosync-library/blob/fa914186025f59b2ead4eda9d3672dae454a295b/rsync/rsync_client.cpp#L61

This worked ok with rsyncd version 3.3.x and earlier, but following the security fix for GHSA-g37v-g3gj-pmwq in commit c44c90e transfers will be rejected with an "invalid uncompressed token length" error. Here is a log fragment showing what happens when the IOS "PhotoBackup" app is used with a recent rsync version on Debian stable 13.5.

2026/06/09 00:45:46 [2396] receiving file list
2026/06/09 00:45:46 [2396] sent 23 bytes  received 47 bytes  total size 0
2026/06/09 00:45:46 [2398] rsync on photos/.photobackup from localhost (::1)
2026/06/09 00:45:46 [2398] building file list
2026/06/09 00:45:48 [2398] sent 547443 bytes  received 57 bytes  total size 547216
2026/06/09 00:45:49 [2399] rsync to photos/ from localhost (::1)
2026/06/09 00:45:49 [2399] receiving file list
2026/06/09 00:45:50 [2399] invalid uncompressed token length 65536 [receiver]
2026/06/09 00:45:50 [2399] rsync error: protocol incompatibility (code 2) at token.c(300) [receiver=3.4.1]
2026/06/09 00:45:50 [2399] rsync error: protocol incompatibility (code 2) at io.c(1704) [generator=3.4.1]

The PhotoBackup app uses the acrosync implementation of rsync and so this bug prevents one of the few easy ways to transfer photos from an Apple device without using some cloud service. Debian stable 13.5 currently has rsync 3.4.1 but it appears that this security fix has been backported from 3.4.3.

Please could you consider a different constraint to replace the token.c change in c44c90e and allow larger chunk sizes? It seems to me that the MIN(...) macro on

rsync/token.c

Line 307 in d0c0ca2

n = MIN(CHUNK_SIZE,residue);

would limit the read to CHUNK_SIZE anyway. If a client could use some reasonable larger sizes such as 64k, perhaps that could be accepted, just for compatibility with third-party rsync implementations? Thanks!

[tridge]

@jwhitham thanks for the report!