Summary
o8v-fs reads file contents into Vec<u8> with no size cap. The most visible site is safe_append_with_separator (which holds an exclusive flock during the read), but safe_read and other read_to_end call sites in o8v-fs are also unbounded.
Why this matters
Running 8v write --append on a large log file or binary will allocate and hold the entire file in memory under the lock. A 1 GB file → 1 GB heap → potential OOM. Same shape applies to safe_read for any large file.
What "fixed" looks like
- A crate-level constant
MAX_FILE_BYTES (or similar), e.g. 64 MB, configurable
- Functions that currently do
read_to_end either (a) return an error when the file exceeds the limit, or (b) stream where it's feasible (append's separator detection only needs the last few bytes once we know the file is well-formed; mixed-ending validation can be a streaming scan)
Out of scope
- Changing the public API of
safe_read to return a streaming iterator. That's a bigger redesign.
- Per-command flags. The limit should be a static crate-level guarantee.
References
Summary
o8v-fsreads file contents intoVec<u8>with no size cap. The most visible site issafe_append_with_separator(which holds an exclusive flock during the read), butsafe_readand otherread_to_endcall sites ino8v-fsare also unbounded.Why this matters
Running
8v write --appendon a large log file or binary will allocate and hold the entire file in memory under the lock. A 1 GB file → 1 GB heap → potential OOM. Same shape applies tosafe_readfor any large file.What "fixed" looks like
MAX_FILE_BYTES(or similar), e.g. 64 MB, configurableread_to_endeither (a) return an error when the file exceeds the limit, or (b) stream where it's feasible (append's separator detection only needs the last few bytes once we know the file is well-formed; mixed-ending validation can be a streaming scan)Out of scope
safe_readto return a streaming iterator. That's a bigger redesign.References
o8v-fs/src/write_guard.rs::guarded_append_with_separator— current full-file read under flocko8v-fs/src/lib.rs::safe_read— same pattern, no flock but same unbounded behavior