From bfe4b810bf78bc96d23610bb6b351c2a9d500773 Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Mon, 10 Aug 2026 19:28:43 -0700 Subject: [PATCH] filer: reject file sizes beyond int64 in the format paths The stored size is uint64; converting a larger value wrapped negative, sizing the repack sniff buffer with make([]byte, -1) - a handler panic - and passing Validate a negative size, which means skip the size check. Refuse repack and answer views stale instead. --- weed/server/filer_server_format.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/weed/server/filer_server_format.go b/weed/server/filer_server_format.go index 2d98adaca..cfd176d59 100644 --- a/weed/server/filer_server_format.go +++ b/weed/server/filer_server_format.go @@ -361,6 +361,10 @@ func (fs *FilerServer) formatRepack(ctx context.Context, w http.ResponseWriter, so.TtlSeconds = roundUpToVolumeTTL(remaining) } + if entry.FileSize > math.MaxInt64 { + writeJsonError(w, r, http.StatusBadRequest, fmt.Errorf("file size %d overflows int64", entry.FileSize)) + return + } size := int64(entry.FileSize) lookup := fs.filer.MasterClient.GetLookupFileIdFunction() chunkViews := filer.ViewFromChunks(ctx, lookup, oldChunks, 0, size) @@ -505,6 +509,12 @@ func (fs *FilerServer) serveFormatView(ctx context.Context, w http.ResponseWrite http.Error(w, "entry has no such format layout", http.StatusNotFound) return } + // a size beyond int64 would read as negative, which Validate treats as + // "skip the size check" + if entry.FileSize > math.MaxInt64 { + http.Error(w, "format layout is stale", http.StatusNotFound) + return + } if err := layout.Validate(int64(entry.FileSize)); err != nil { glog.WarningfCtx(ctx, "stale format layout on %s: %v", entry.FullPath, err) http.Error(w, "format layout is stale", http.StatusNotFound)