Finding
volume_set_size() (line 145) — the 'compressed size' denominator for the RAR decompression-ratio guard — sums the on-disk size of every file in the archive's directory whose extension matches .rar/.rNN with no magic-byte or volume-membership check, so an attacker padding the torrent dir with an unrelated large junk-extension file inflates the denominator and lets a real decompression bomb pass the max_decompression_ratio gate.
Evidence
crates/ergasia/src/extract/rar.rs:145. Surfaced by the 2026-07-03 deep-audit workflow (adversarially verified + Opus-judged).
Why this matters
Padding a torrent directory with junk-extension files inflates the compressed-size denominator, letting a genuine decompression bomb sail past the guard meant to stop it — a resource-exhaustion/disk-fill vector.
Desired correction
Derive the compressed denominator from the actual volume set unrar reports for this archive (open_for_listing volume membership) rather than a directory-wide extension glob; at minimum magic-byte-verify each file and correlate it to the archive's volume chain.
Done when: the defect's failure mode no longer reproduces and a regression test covers it.
Finding
volume_set_size() (line 145) — the 'compressed size' denominator for the RAR decompression-ratio guard — sums the on-disk size of every file in the archive's directory whose extension matches .rar/.rNN with no magic-byte or volume-membership check, so an attacker padding the torrent dir with an unrelated large junk-extension file inflates the denominator and lets a real decompression bomb pass the max_decompression_ratio gate.
Evidence
crates/ergasia/src/extract/rar.rs:145. Surfaced by the 2026-07-03 deep-audit workflow (adversarially verified + Opus-judged).Why this matters
Padding a torrent directory with junk-extension files inflates the compressed-size denominator, letting a genuine decompression bomb sail past the guard meant to stop it — a resource-exhaustion/disk-fill vector.
Desired correction
Derive the compressed denominator from the actual volume set unrar reports for this archive (open_for_listing volume membership) rather than a directory-wide extension glob; at minimum magic-byte-verify each file and correlate it to the archive's volume chain.
Done when: the defect's failure mode no longer reproduces and a regression test covers it.