4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	d00982b329	Fuzz NewManifestFromReader and cap the zstd decoder (closes #65) ... FuzzNewManifestFromReader fails when the parser returns both or neither of a manifest and an error, or allocates more than a fixed multiple of its input and the decompressed data it may read, plus room for the decoder's window buffers. make test runs the seed corpus; make fuzz fuzzes for one minute. Parser bug: MaxDecompressedSize did not bound decompression; the zstd decoder decoded a payload under 128 KiB in full before the LimitReader read any of it. It now decodes only what the LimitReader reads and refuses windows over the 8 MiB mfer writes with. Seeds: a frame claiming 8 GiB, two frames together over the limit, empty frames with growing windows. Model: opus-5-5	2026-10-04 05:31:51 +02:00
clawbot	de476708e9	Update golangci-lint to v2.12.2 with canonical config (closes #60) ... Adopts golangci-lint v2.12.2 and the canonical .golangci.yml (default: all), and fixes all resulting findings across the tree. Two intended behavior changes: absent MFFilePath.Mtime is handled explicitly in freshen, list and export rather than dereferenced (main panicked); gpg positional key IDs now follow an explicit -- end-of-options marker. All twelve reworded user-visible error messages restored to byte-identical parity with main and pinned by tests.	2026-08-10 16:06:12 +02:00
3 people	7144617d0e	Add decompression size limit in deserializeInner() (closes #24) (#29) ... Wrap zstd decompressor with `io.LimitReader` (256MB max) to prevent decompression bombs. Co-authored-by: clawbot <clawbot@openclaw> Co-authored-by: Jeffrey Paul <sneak@noreply.example.org> Reviewed-on: #29 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-02-09 01:45:55 +01:00
sneak	6edc798de0	Add version line after banner with release date ... Added mfer/constants.go with Version and ReleaseDate constants for deterministic builds. Banner now shows "mfer by @sneak: v0.1.0 released 2025-12-17"	2025-12-17 15:23:55 -08:00