filer: reject file sizes beyond int64 in the format paths

The stored size is uint64; converting a larger value wrapped negative,
sizing the repack sniff buffer with make([]byte, -1) - a handler panic -
and passing Validate a negative size, which means skip the size check.
Refuse repack and answer views stale instead.

weed/server/filer_server_format.go

@@ -361,6 +361,10 @@ func (fs *FilerServer) formatRepack(ctx context.Context, w http.ResponseWriter,
 		so.TtlSeconds = roundUpToVolumeTTL(remaining)
 	}
 
+	if entry.FileSize > math.MaxInt64 {
+		writeJsonError(w, r, http.StatusBadRequest, fmt.Errorf("file size %d overflows int64", entry.FileSize))
+		return
+	}
 	size := int64(entry.FileSize)
 	lookup := fs.filer.MasterClient.GetLookupFileIdFunction()
 	chunkViews := filer.ViewFromChunks(ctx, lookup, oldChunks, 0, size)
@@ -505,6 +509,12 @@ func (fs *FilerServer) serveFormatView(ctx context.Context, w http.ResponseWrite
 		http.Error(w, "entry has no such format layout", http.StatusNotFound)
 		return
 	}
+	// a size beyond int64 would read as negative, which Validate treats as
+	// "skip the size check"
+	if entry.FileSize > math.MaxInt64 {
+		http.Error(w, "format layout is stale", http.StatusNotFound)
+		return
+	}
 	if err := layout.Validate(int64(entry.FileSize)); err != nil {
 		glog.WarningfCtx(ctx, "stale format layout on %s: %v", entry.FullPath, err)
 		http.Error(w, "format layout is stale", http.StatusNotFound)