Skip to content

fix: limit FileHeader.ReadAll to declared file size#69

Merged
alexferl merged 1 commit intomasterfrom
fh_size
Mar 10, 2026
Merged

fix: limit FileHeader.ReadAll to declared file size#69
alexferl merged 1 commit intomasterfrom
fh_size

Conversation

@alexferl
Copy link
Copy Markdown
Owner

Use the Size field from FileHeader to limit the amount of data read, preventing OOM attacks where a client could upload more data than expected. If Size is 0, falls back to unlimited reading.

Use the Size field from FileHeader to limit the amount of data read,
preventing OOM attacks where a client could upload more data than
expected. If Size is 0, falls back to unlimited reading.

Signed-off-by: alexferl <me@alexferl.com>
@coveralls
Copy link
Copy Markdown

Pull Request Test Coverage Report for Build 22926925217

Details

  • 3 of 3 (100.0%) changed or added relevant lines in 1 file are covered.
  • 5 unchanged lines in 2 files lost coverage.
  • Overall coverage decreased (-0.03%) to 93.429%

Files with Coverage Reduction New Missed Lines %
bind.go 1 91.15%
sse.go 4 93.37%
Totals Coverage Status
Change from base Build 22926680321: -0.03%
Covered Lines: 8090
Relevant Lines: 8659

💛 - Coveralls

@alexferl alexferl merged commit 0937f8b into master Mar 10, 2026
9 checks passed
@alexferl alexferl deleted the fh_size branch March 10, 2026 22:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants