Files
craft-libs/crates/fig/src
Dylan M. Taylor c86ea6802a craft-ora, craft-kra: charge every entry to one document-wide total (#1339)
An archive could hold many individually allowed members whose combined
decompression was unbounded, because both readers passed
max_total_bytes: u64::MAX to craft-zip. Each now passes MAX_TOTAL (4 GiB)
and every entry read is charged to it.

craft-fig's declared-entry cap drops from 1,000,000 to 100,000 to match the
other ZIP readers; its images were already bounded by Limits::max_image_total.
2026-11-14 13:45:31 -05:00
..