1 file changed, 11 insertions, 0 deletions
diff --git a/source/ui-snapshot.c b/source/ui-snapshot.c
index f4e79f7..bd5ebf2 100644
--- a/source/ui-snapshot.c
+++ b/source/ui-snapshot.c
@@ -304,6 +304,17 @@ static int send_sig(const struct cgit_snapshot_format *format, const char *hex,
 		return 0;
 	}
 
+	// A note is any blob a pusher stored, so it is held to the same bound
+	// as every other blob a page inflates.
+	if (odb_read_object_info(the_repository->objects, note, &size) != OBJ_BLOB) {
+		cgit_print_error_page(404, "Not Found", "Not found");
+		return 0;
+	}
+	if (cgit_blob_too_large(size)) {
+		cgit_print_blob_too_large(size);
+		return 0;
+	}
+
 	buf = odb_read_object(the_repository->objects, note, &type, &size);
 	if (!buf) {
 		cgit_print_error_page(404, "Not Found", "Not found");