permissionlesstech/bitchat-android
1
0
Fork 0
mirror of https://github.com/permissionlesstech/bitchat-android.git synced 2026-07-27 14:05:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Align compressed payload send and receive bounds (#736)

Browse Source 
* Align compressed payload send and receive bounds

* Preserve ambiguous raw deflate compatibility

* Pool decompression by memory budget
This commit is contained in:
a1denvalu3
2026-07-26 11:52:55 +02:00
committed by GitHub
parent fc9abffe0c
commit 55f9e7cac4
9 changed files with 290 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/file_transfer.md
+5 -4
View File
@@ -99,10 +99,11 @@ complete deflate stream. The `FILE_TRANSFER (0x22)` byte cannot safely grant a l
attacker-controlled before packet signature verification, and the current receive pipeline must
inflate before it can perform that verification.
This intentionally means a legacy Android sender can produce a highly compressible public file
between 10 MiB and the UI's 50 MiB send limit that the bounded decoder rejects. The hardening must
therefore remain a rollout HOLD rather than silently ship as backward compatible. Grandfathering
50 MiB also is not safe after only a type check: inflation allocates the declared payload and
New Android senders cap files just below 10 MiB (reserving envelope overhead) and refuse to encode
any payload above the receiver ceiling.
Legacy Android senders can still produce a highly compressible public file between 10 MiB and their
50 MiB UI limit that the bounded decoder rejects. Grandfathering 50 MiB is not safe after only a type
check: inflation allocates the declared payload and
`BitchatFilePacket.decode` currently copies the content again, creating a greater than 100 MiB peak
for a maximum-size transfer.