mirror of
https://github.com/storytold/vectorcraft.git
synced 2026-10-29 20:27:05 -06:00
Don Omondi
d60b6bf883
NodeKind's reader buffers the fields that come before `type` as serde_json::Values. VectorCraft writes `type` first, but a crafted file can put a long array there: a group whose children held 50M numbers before its type (a 96 KB gzip) peaked at 1.6 GB, and the cost grows with the array up to MAX_JSON, before any object in it is counted. The buffer is read through a counting visitor: each JSON value counts against MAX_BUFFERED_VALUES (32M, 4M on wasm32) as it is read, and values replayed from the buffer aren't counted twice. load_file reads within it; the same file is now refused at a 1.1 GB peak.