From e5587d89796b51a8226fb00a225b1006e406f659 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Wed, 15 Jul 2026 16:11:30 -1000 Subject: Check `max-blob-size` before reading, default 10 MB Only the tree view honoured the limit, and only after loading the whole object. The raw blob, plain, blame and readme paths now check the size before reading, and the default moves from unlimited to 10 MB so a fresh install never buffers a huge object whole, with zero still the opt-out. --- source/cgit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'source/cgit.c') diff --git a/source/cgit.c b/source/cgit.c index 8a7027c..d80aebd 100644 --- a/source/cgit.c +++ b/source/cgit.c @@ -403,7 +403,7 @@ static void prepare_context(void) ctx.cfg.max_lock_attempts = 5; ctx.cfg.max_msg_len = 80; ctx.cfg.max_repodesc_len = 80; - ctx.cfg.max_blob_size = 0; + ctx.cfg.max_blob_size = 10 * 1024; /* 10 MB; bounds per-request memory */ ctx.cfg.max_stats = 0; ctx.cfg.project_list = NULL; ctx.cfg.renamelimit = -1; -- cgit v2.8.0