jochen
539a1c16cd
mesh/merge-gate head 539a1c16cd4e merged into trunk ba685b17f5e1 — pass: builds build-agent, mesh-controller, route-proxy → ace, g14, novox, shanks; no bus…
mesh/repo-check head 539a1c16cd4e merged into trunk ba685b17f5e1 — pass: its merge-check.sh passed
mesh/delivery delivered
The xz reader keeps one delta or BCJ decoder for every block of a stream and frees them only when the stream ends, so a file of many tiny blocks grows the heap with its length: about 67 MiB live for a 6 MB `xz --block-size=1 --delta` file, about 5.6 GiB at the 512 MiB download cap. The file's framing is now walked first, without decompressing: stream header, each block header, the LZMA2 chunk headers (each carries its compressed size, so a chunk is skipped unread), padding, check, index and footer. A file of more than 1,024 blocks or 16 streams is refused, as is an index whose block count is not the count walked. The index alone is not trusted because the reader compares it with the blocks only after decoding them all, so a lying index would still be decoded. Refusing delta and BCJ outright was not chosen: it needs the same walk to see each block header, and would refuse sound releases filtered with BCJ. 1,024 blocks keep at most about 0.35 MiB of decoders. Betterbird's archive is 1 stream with 1 block; multi-threaded xz cuts blocks of 3 times the dictionary, so 512 MiB in blocks of 512 KiB still fits. The library stays unforked.