mirror of
https://github.com/storytold/cadcraft.git
synced 2026-10-30 05:46:50 -06:00
Books
1d6c72db11
* Bound the MCP client's reply read and the control server's total buffered bytes (#1925) The MCP client read replies with an unbounded read_line; a process squatting on the control port could make it allocate without limit. It now reads through take() with a 256 MiB cap (the server's own request cap) and fails with a clear error. The control server allowed max_clients x max_line (16 x 256 MiB) buffered at once. Request-line bytes are now charged against a shared 512 MiB budget; a request that would pass it gets an error reply and the connection closes. * Parity checklist: regenerated after merging main * control_server: drop unused Read import (#1925) * control_server: tests import Read themselves (#1925) The unused-import cleanup removed std::io::Read from the module, but a test still calls read_to_end, so the test build failed on CI.