mirror of
https://github.com/storytold/wordcraft.git
synced 2026-10-31 05:47:00 -06:00
Finding 43. Package::open_limited dropped an entry whose read failed before adding the bytes it had already inflated to the running total, so many entries with a wrong CRC (checked only after the whole stream inflates) could each inflate up to the part limit for free. The bytes are now charged first and the size check runs before the read result is looked at. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>