| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
31b901b93b checked the TOC with unchecked arithmetic on counts and
offsets read from the file. The record-table size (u64 count times
record size) and u32 first_child + child_count can wrap, so the bounds
checks pass and later reads go out of bounds; the same holds for the
TOC range, name ranges, file extents and the meta range. A directory
that lists its own ancestor as a child also made BuildDirTree recurse
until the stack overflowed.
Bound the counts by the TOC size before multiplying, compare ranges by
subtraction, and widen the child range to u64. Walk the directory graph
once after parsing with an explicit stack and reject cycles and nesting
deeper than 128, so BuildDirTree can no longer recurse without bound.
The file is rejected with ErrorNUPBadFormat.
Assisted-by: Claude Sonnet 5.5 (implementation and commit message)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
31b901b93b only cached a zstd member while it fit the 512 MiB cache.
Anything larger was never cached, so every Read() allocated the full
uncompressed size and decompressed the whole extent again, which makes a
multi-GB RomFS read in small chunks unusably slow. Members between 256
and 512 MiB evicted each other on alternate reads, and Insert copied the
vector so memory briefly doubled. Two threads decompressing the same
member also left a duplicate LRU entry and a wrong byte count.
The writer emits one zstd frame per member, so there are no frame
boundaries to seek by. Members larger than half the cache are now
streamed once into a temporary file under the cache directory and read
from there, using bounded memory. The file is removed when the
container is released. Smaller members stay in the LRU, which now moves
the vector in and ignores a duplicate insert.
Assisted-by: Claude Sonnet 5.5 (implementation and commit message)
|
