From 846f4055ea29469bfdcd14de2a5aa19acf62c005 Mon Sep 17 00:00:00 2001 From: Ievgen Bondarenko Date: Thu, 21 May 2026 19:01:18 -0700 Subject: [PATCH] lisafs: bound Walk and WalkStat response payloads to maxMessageSize WalkHandler and WalkStatHandler size the response payload buffer from the request-controlled path length and only reject it when it exceeds math.MaxUint32 (4 GiB). comm.PayloadBuf slices into a window of maxMessageSize bytes, so any size between maxMessageSize and MaxUint32 indexes past that window. The sibling PReadHandler bounds its response payload against c.maxMessageSize. Apply the same bound to both Walk handlers. math is no longer referenced in the file, so its import is dropped. --- pkg/lisafs/handlers.go | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/pkg/lisafs/handlers.go b/pkg/lisafs/handlers.go index 2dc3ec916c..7696d26306 100644 --- a/pkg/lisafs/handlers.go +++ b/pkg/lisafs/handlers.go @@ -16,7 +16,6 @@ package lisafs import ( "fmt" - "math" "os" "strings" @@ -304,7 +303,7 @@ func WalkHandler(c *Connection, comm Communicator, payloadLen uint32) (uint32, e ) respMetaSize := status.SizeBytes() + numInodes.SizeBytes() maxPayloadSize := respMetaSize + (len(req.Path) * (*Inode)(nil).SizeBytes()) - if maxPayloadSize > math.MaxUint32 { + if maxPayloadSize > int(c.maxMessageSize) { // Too much to walk, can't do. return 0, unix.EIO } @@ -406,7 +405,7 @@ func WalkStatHandler(c *Connection, comm Communicator, payloadLen uint32) (uint3 // the same as WalkStatResp's. var numStats primitive.Uint16 maxPayloadSize := numStats.SizeBytes() + (len(req.Path) * SizeOfStatx) - if maxPayloadSize > math.MaxUint32 { + if maxPayloadSize > int(c.maxMessageSize) { // Too much to walk, can't do. return 0, unix.EIO }