Hamza 332b0d9f5c links: a linked file is read under a cap, not whole (#1596) ...

Update, Relink and Relink Folder all reload a linked graphic through `reload`,
which read the file with an unbounded `read`. A document whose link points at a
multi-GB file exhausted memory on Update. How large a linked file is belongs to
whoever wrote the document, not to whoever opens it: the path comes out of the
document.

`reload` now reads through `read_capped` at the limit packaging already applies
to a linked file (`MAX_LINKED_FILE_BYTES`, 256 MB), and a file over it is
refused by name instead of read. `reload_capped` takes the cap so a test can
show both sides without a 256 MB fixture.

Not changed: `file.place` reads a path the same unbounded way, but there the
user picked the file, where a link's path can come from a document someone else
wrote. Whether that read wants the same cap is a call for a maintainer, so it
is reported rather than changed.

Found in the audit of #1596 (DC-15).

2026-10-24 16:07:21 +05:00

..

src

links: a linked file is read under a cap, not whole (#1596)

2026-10-24 16:07:21 +05:00

tests/it

M6: harden placed PDF layer variants (#1670)

2026-10-24 00:18:22 -06:00

Cargo.toml

Follow paths stored in documents only on this computer or the document's share

2026-10-16 17:05:09 +00:00