Check `max-blob-size` before reading, default 10 MB

Only the tree view honoured the limit, and only after loading the
whole object. The raw blob, plain, blame and readme paths now check
the size before reading, and the default moves from unlimited to
10 MB so a fresh install never buffers a huge object whole, with zero
still the opt-out.

1 file changed, 10 insertions, 0 deletions

diff --git a/source/ui-blob.c b/source/ui-blob.c
index ad84f3d..67c718b 100644
--- a/source/ui-blob.c
+++ b/source/ui-blob.c
@@ -102,6 +102,8 @@ int cgit_print_file(char *path, const char *head, int file_only, int html_escape
 	}
 	if (type == OBJ_BAD)
 		return -1;
+	if (ctx.cfg.max_blob_size && size / 1024 > (unsigned long)ctx.cfg.max_blob_size)
+		return -1;
 	buf = odb_read_object(the_repository->objects, &oid, &type, &size);
 	if (!buf)
 		return -1;
@@ -170,6 +172,14 @@ void cgit_print_blob(const char *hex, char *path, const char *head, int file_onl
 		return;
 	}
 
+	/* Reject an oversized object before reading it whole into memory. */
+	if (ctx.cfg.max_blob_size && size / 1024 > (unsigned long)ctx.cfg.max_blob_size) {
+		cgit_print_error_page(413, "Too large",
+				"Object size (%luKB) exceeds limit (%dKB)",
+				size / 1024, ctx.cfg.max_blob_size);
+		return;
+	}
+
 	buf = odb_read_object(the_repository->objects, &oid, &type, &size);
 	if (!buf) {
 		cgit_print_error_page(500, "Internal server error",