apt: control files are capped at 64 KiB and indexes are rendered one list at a time

crates/formats/apt/src/control.rs

@@ -10,8 +10,12 @@
 use std::collections::HashSet;
 use std::fmt;
 
-/// The longest control file read from a package, in bytes.
-pub const MAX_CONTROL_BYTES: usize = 1024 * 1024;
+/// The longest control file read from a package, in bytes. Debian's
+/// largest control files are a few KiB (a long `Description`, the
+/// `Provides` of a metapackage); 64 KiB leaves room for any real one. An
+/// index lists each package's control data once per architecture, so this
+/// bounds what a package costs every index it is in (#797).
+pub const MAX_CONTROL_BYTES: usize = 64 * 1024;
 
 /// The most fields a paragraph may hold. Real paragraphs hold a few dozen:
 /// a binary package's control file has the 20-odd fields of Debian Policy
@@ -777,12 +781,14 @@ mod tests {
 
     #[test]
     fn a_control_file_of_many_fields_is_refused_quickly() {
-        // A whole control file (1 MiB) of distinct short fields: about
-        // 100,000 of them, which took ~20 s when each field was compared
-        // with every earlier one.
+        // 1 MiB of distinct short fields (what a control file could hold
+        // before #797; an index's text can hold more): about 100,000 of
+        // them, which took ~20 s when each field was compared with every
+        // earlier one.
+        const BYTES: usize = 1024 * 1024;
         let mut text = String::new();
         let mut i = 0;
-        while text.len() < MAX_CONTROL_BYTES - 16 {
+        while text.len() < BYTES - 16 {
             text.push_str(&format!("a{i}:\n"));
             i += 1;
         }
@@ -797,7 +803,7 @@ mod tests {
         // Distinct fields spread over paragraphs under the bound are read
         // in linear time too.
         let mut text = String::new();
-        while text.len() < MAX_CONTROL_BYTES - 8192 {
+        while text.len() < BYTES - 8192 {
             text.push_str(&fields(MAX_FIELDS));
             text.push('\n');
         }

crates/formats/apt/src/deb.rs

@@ -337,7 +337,10 @@ fn control_in_tar(tar: impl Read) -> Result<Vec<u8>, DebError> {
             return invalid("the package's control is not a file");
         }
         if entry.size() > MAX_CONTROL_BYTES as u64 {
-            return invalid("the package's control file is too large");
+            return invalid(format!(
+                "the package's control file is larger than {} KiB",
+                MAX_CONTROL_BYTES >> 10
+            ));
         }
         let mut control = Vec::new();
         entry
@@ -519,6 +522,20 @@ pub(crate) mod tests {
         assert!(err.to_string().contains("no control file"), "{err}");
     }
 
+    #[test]
+    fn a_control_file_over_the_cap_is_refused() {
+        // A control file of exactly the cap is read; one byte more is
+        // refused (#797: it was 1 MiB).
+        let head = "Package: big\nVersion: 1\nArchitecture: all\nDescription: x\n ";
+        let at_cap = format!("{head}{}\n", "y".repeat(MAX_CONTROL_BYTES - head.len() - 1));
+        assert_eq!(at_cap.len(), MAX_CONTROL_BYTES);
+        let read = control_file(&mut Cursor::new(deb_of(&[("./control", &at_cap)]))).unwrap();
+        assert_eq!(read.len(), MAX_CONTROL_BYTES);
+        let over = format!("{at_cap}z");
+        let err = control_file(&mut Cursor::new(deb_of(&[("./control", &over)]))).unwrap_err();
+        assert!(err.to_string().contains("larger than 64 KiB"), "{err}");
+    }
+
     /// A `.deb` whose control member holds a regular file of `data` at each
     /// of `files`' paths, as written: a leading `/` is kept.
     fn deb_of(files: &[(&str, &str)]) -> Vec<u8> {