Skip to content

fix: improve slurp() robustness with size limit and read loop#12

Merged
imichaelmoore merged 1 commit into
troydhanson:masterfrom
imichaelmoore:fix-slurp-memory-safety
Nov 29, 2025
Merged

fix: improve slurp() robustness with size limit and read loop#12
imichaelmoore merged 1 commit into
troydhanson:masterfrom
imichaelmoore:fix-slurp-memory-safety

Conversation

@imichaelmoore

Copy link
Copy Markdown
Collaborator

Several issues in slurp():

  1. No size limit - A large dependency file could exhaust memory
  2. Partial reads - read() can return fewer bytes than requested; the code treated this as an error
  3. EINTR - Interrupted system calls weren't retried

Fix:

  • Add 10MB size limit (SLURP_MAX_SIZE)
  • Read in a loop until all bytes are received
  • Retry on EINTR
  • Log malloc failures

@imichaelmoore imichaelmoore changed the title Improve slurp() robustness fix: improve slurp() robustness with size limit and read loop Nov 27, 2025
@troydhanson

Copy link
Copy Markdown
Owner

Can you rebase this and resolve the conflict?

Addresses several issues in slurp():

1. No size limit - A large dependency file could exhaust memory
2. Partial reads - read() can return fewer bytes than requested
3. EINTR - Interrupted system calls weren't retried

Fix:
- Add 10MB size limit (SLURP_MAX_SIZE)
- Read in a loop until all bytes are received
- Retry on EINTR
- Log malloc failures

Note: Preserves the TOCTOU fix from PR #9 (fstat after open).
@imichaelmoore
imichaelmoore force-pushed the fix-slurp-memory-safety branch from 855c958 to a5f5415 Compare November 29, 2025 18:47
@imichaelmoore
imichaelmoore merged commit b5071f0 into troydhanson:master Nov 29, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants