brianmcgee
4ff7d20b8e
PR Size Review Check / pr-size-review-gate (pull_request) Successful in 46s
sizelint / sizelint (pull_request) Successful in 1m0s
buildbot/nix-build gitea:clan/data-mesher#checks.aarch64-linux.nixos-data-mesher-basic Build done.
buildbot/nix-eval Build done.
buildbot/nix-build Build done.
gitea-mq/buildbot/nix-eval Build done.
gitea-mq/buildbot/nix-build Build done.
gitea-mq Merge queue passed
Three msgpack decoders read directly from unbounded libp2p streams: file-transfer server (`FileRequest`), file-transfer client (`FileResponse`), and the outbound state-exchange response. A malicious peer can stream arbitrarily large strings into decoded fields, causing the victim to allocate memory until OOM. Wrap all peer-facing decoders in `io.LimitReader`. The inbound state-exchange handler (`handleStream`) already had this protection; the other three paths were missed.