Repository navigation
src: avoid truncating Blob sizes to 32 bits - #66207
Merged
nodejs-github-bot merged 1 commit intoOct 22, 2026
Merged
Conversation
Blob sizes cross between C++ and JavaScript as uint32 values, while the underlying DataQueue tracks them as uint64. openAsBlob() on a 5 GiB file therefore returned a Blob of size 1073741824. Reporting the real size is not enough on its own. The inbound direction assumes a uint32 as well, so a correct size reaches CHECK(IsUint32()) in ToSlice() and StoreDataObject() and aborts blob.slice() and URL.createObjectURL(). Pass the sizes as doubles and keep them as uint64_t in C++. Everything below this boundary is already 64-bit, so this only stops the narrowing at the edge. Signed-off-by: Christian Aurich Zanettini Martins <christian.aurichzm@gmail.com>
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #66207 +/- ##
========================================
Coverage 90.29% 90.29%
========================================
Files 790 790
Lines 272529 272883 +354
Branches 52037 52111 +74
========================================
+ Hits 246074 246404 +330
- Misses 16908 16940 +32
+ Partials 9547 9539 -8
🚀 New features to boost your workflow:
|
Member
Author
|
@addaleax since you reviewed the last openAsBlob() change in nodejs/node#65517, could you take a look at this one when you get a chance? cc @legendecas. If it looks good, could you also add request-ci? Thanks! |
dmihalcik-virtru
added a commit
to opentdf/web-sdk
that referenced
this pull request
Oct 15, 2026
Node's fs.openAsBlob reports a file-backed Blob's size mod 2^32 (nodejs/node#66207), so the zip reader's tail read of any TDF >= 4 GiB landed mid-payload and decrypt/inspect failed with 'Unable to retrieve CD manifest'. Open input files with a FileHandle-backed Chunker that reads by explicit 64-bit-safe position instead, and use it for both encrypt and decrypt. Small JSON option files now use readFile.
dmihalcik-virtru
added a commit
to opentdf/web-sdk
that referenced
this pull request
Oct 15, 2026
Node's fs.openAsBlob reports a file-backed Blob's size mod 2^32 (nodejs/node#66207), so the zip reader's tail read of any TDF >= 4 GiB landed mid-payload and decrypt/inspect failed with 'Unable to retrieve CD manifest'. Open input files with a FileHandle-backed Chunker that reads by explicit 64-bit-safe position instead, and use it for both encrypt and decrypt. Small JSON option files now use readFile.
dmihalcik-virtru
added a commit
to opentdf/web-sdk
that referenced
this pull request
Oct 15, 2026
Node's fs.openAsBlob reports a file-backed Blob's size mod 2^32 (nodejs/node#66207), so the zip reader's tail read of any TDF >= 4 GiB landed mid-payload and decrypt/inspect failed with 'Unable to retrieve CD manifest'. Open input files with a FileHandle-backed Chunker that reads by explicit 64-bit-safe position instead, and use it for both encrypt and decrypt. Small JSON option files now use readFile. Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>
dmihalcik-virtru
added a commit
to opentdf/web-sdk
that referenced
this pull request
Oct 15, 2026
Node's fs.openAsBlob reports a file-backed Blob's size mod 2^32 (nodejs/node#66207), so the zip reader's tail read of any TDF >= 4 GiB landed mid-payload and decrypt/inspect failed with 'Unable to retrieve CD manifest'. Open input files with a FileHandle-backed Chunker that reads by explicit 64-bit-safe position instead, and use it for both encrypt and decrypt. Small JSON option files now use readFile. Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>
mmaudet
pushed a commit
to mmaudet/web-sdk
that referenced
this pull request
Oct 16, 2026
…0) (opentdf#1089) * fix(cli): read file input by position instead of openAsBlob (DSPX-5160) Node's fs.openAsBlob reports a file-backed Blob's size mod 2^32 (nodejs/node#66207), so the zip reader's tail read of any TDF >= 4 GiB landed mid-payload and decrypt/inspect failed with 'Unable to retrieve CD manifest'. Open input files with a FileHandle-backed Chunker that reads by explicit 64-bit-safe position instead, and use it for both encrypt and decrypt. Small JSON option files now use readFile. Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com> * fix(cli): reject changed file input while reading (DSPX-5160) Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com> * fix(cli): accept BOM in assertion JSON files (DSPX-5160) Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com> * fix(cli): reject FIFOs and other non-files without blocking (DSPX-5160) Open the input with O_NONBLOCK so a FIFO with no writer does not hang open() before the isFile() check can reject it. Also keep a failed close() from replacing the reason the file was rejected. Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com> * fix(cli): say why an input file is not accessible (DSPX-5160) The logger does not print a CLIError's cause, so the 'not a regular file' and 'too large' reasons were hidden behind a generic message. Include the cause in the message, and fix the 'accessable' typo. Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com> * fix(cli): keep input cleanup from masking errors (DSPX-5160) closeSource now logs a close failure instead of throwing, so it cannot replace the real error from a finally block, and it runs before the client's close() so a throwing close() cannot skip it. The read and create option parsers also close the input file if a later option (assertions, verification keys, rewrap key type) fails to parse. Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com> --------- Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>
Member
Author
panva
approved these changes
Oct 22, 2026
Collaborator
Collaborator
Collaborator
|
Landed in 1c12ff1 |
lukax
added a commit
to PinataCloud/pinata
that referenced
this pull request
Nov 12, 2026
…t scales with size Read the file for a resumable upload from file.stream() instead of file.slice(). Node's Blob is broken past 2^32 bytes (nodejs/node#66207): fs.openAsBlob() reports the size modulo 2^32, so the SDK uploaded a truncated file, and slice() past 2^32 on a correctly sized Blob aborts the process. Chunks keep their size and headers; the current chunk stays in memory so a failed PATCH can resend it, or its remainder when the server stored part of it. Before the PATCH that would complete the upload, the SDK checks that the stream has no more bytes, and throws a ValidationError instead of completing a truncated upload. Wait 5 minutes per GiB (was 1) for a finished upload to be registered: processing a large file can take longer than the old limit allowed. The timeout error now says the upload is still processing and gives the upload URL to poll with HEAD.
lukax
added a commit
to PinataCloud/pinata
that referenced
this pull request
Nov 12, 2026
…t scales with size (#102) * fix: resumable uploads over 4 GiB in Node and a registration wait that scales with size Read the file for a resumable upload from file.stream() instead of file.slice(). Node's Blob is broken past 2^32 bytes (nodejs/node#66207): fs.openAsBlob() reports the size modulo 2^32, so the SDK uploaded a truncated file, and slice() past 2^32 on a correctly sized Blob aborts the process. Chunks keep their size and headers; the current chunk stays in memory so a failed PATCH can resend it, or its remainder when the server stored part of it. Before the PATCH that would complete the upload, the SDK checks that the stream has no more bytes, and throws a ValidationError instead of completing a truncated upload. Wait 5 minutes per GiB (was 1) for a finished upload to be registered: processing a large file can take longer than the old limit allowed. The timeout error now says the upload is still processing and gives the upload URL to poll with HEAD. * fix: cut files held in memory with slice(), so a resumable upload holds one chunk Node's Blob.stream() hands over each part held in memory (a Buffer, a string, a File parsed from FormData) whole and as a copy. Reading a File built from one large Buffer through the stream therefore held a second copy of the file until the upload ended. FileChunks now cuts such files with slice(), which does not copy, and sends each chunk as a Blob, as before. Chunks that end past 2^32 - 1 bytes, and files that may report too small a size, still come from StreamChunks, which refuses to complete an upload whose stream holds more bytes than file.size. The stream tells the two apart: the MiB before the reported size comes in one piece when it is held in memory, and in small pieces from a file opened with fs.openAsBlob(), whose real bytes cover that position whenever its size is wrong. A failed upload's error now includes the server's reason only when it gives one (Upload-Error), and the timeout error no longer promises that header.
aduh95
pushed a commit
that referenced
this pull request
Nov 12, 2026
Blob sizes cross between C++ and JavaScript as uint32 values, while the underlying DataQueue tracks them as uint64. openAsBlob() on a 5 GiB file therefore returned a Blob of size 1073741824. Reporting the real size is not enough on its own. The inbound direction assumes a uint32 as well, so a correct size reaches CHECK(IsUint32()) in ToSlice() and StoreDataObject() and aborts blob.slice() and URL.createObjectURL(). Pass the sizes as doubles and keep them as uint64_t in C++. Everything below this boundary is already 64-bit, so this only stops the narrowing at the edge. Signed-off-by: Christian Aurich Zanettini Martins <christian.aurichzm@gmail.com> PR-URL: #66207 Fixes: #52585 Refs: #52588 Reviewed-By: Filip Skokan <panva.ip@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Blob sizes cross between C++ and JavaScript as uint32 values, while the
underlying DataQueue tracks them as uint64. openAsBlob() on a 5 GiB file
therefore returned a Blob of size 1073741824.
Reporting the real size is not enough on its own. The inbound direction
assumes a uint32 as well, so a correct size reaches CHECK(IsUint32()) in
ToSlice() and StoreDataObject() and aborts blob.slice() and
URL.createObjectURL(). StoreDataObject() does not need openAsBlob() to be
reached, since an in-memory Blob is bounded by Uint8Array::kMaxLength
rather than by 4 GiB.
Pass the sizes as doubles and keep them as uint64_t in C++. Everything
below this boundary, FdEntry and FileHandle included, is already 64-bit,
so this only stops the narrowing at the edge. It also removes the
truncation on 32-bit platforms, where size_t was too narrow as well.
Fixes: #52585
Refs: #52588