Fuzz NewManifestFromReader and cap the zstd decoder (closes #65)

FuzzNewManifestFromReader fails when the parser returns both or neither
of a manifest and an error, or allocates more than sixteen times its
input and the decompressed data it may read, plus room for the decoder's
window. make test runs the committed seed corpus; make fuzz fuzzes for
one minute, by hand only.

Parser bug: MaxDecompressedSize did not bound decompression. The zstd
decoder decoded a payload under 128 KiB in full, each frame up to its
own 64 GiB limit, before the LimitReader read any of it. It now decodes
synchronously, only what the LimitReader reads, with MaxDecompressedSize
as its limit. Regression seeds: a frame claiming 8 GiB, and two frames
each under the limit and together over it.

Model: opus-5-5

TODO.md

@@ -26,8 +26,12 @@ only thing left of the `chore/align-repo-policies` branch is the list below.
 
 - 2026-10-03: added `FuzzNewManifestFromReader` and its seed corpus, which
   `make test` runs, plus `make fuzz` for a one-minute run by hand; the zstd
-  decoder now has `MaxDecompressedSize` as its limit, so a frame claiming a
-  large size can no longer make the parser allocate that size (#65)
+  decoder now decodes only as many bytes as the parser reads, and has
+  `MaxDecompressedSize` as its limit, so neither a frame claiming a large size
+  nor several frames together can make the parser allocate past that limit (#65)
+- 2026-10-03: pinned the CLI error messages by driving the functions that emit
+  them in `internal/cli/errmsg_test.go`, and made the freshen mtime-presence
+  test distinguish an absent mtime from the epoch (#87)
 - 2026-10-03: `script/cibuild` builds the image with the same command as
   `script/docker`, `--no-cache` included, so the checks in the Dockerfile run on
   every build, also on an unchanged tree (#89)

internal/cli/errmsg_test.go

@@ -2,167 +2,352 @@
 package cli
 
 import (
-	"fmt"
+	"bytes"
+	"context"
+	"flag"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"os/exec"
+	"path/filepath"
 	"testing"
 
+	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	urfcli "github.com/urfave/cli/v2"
+	"sneak.berlin/go/mfer/mfer"
 )
 
-// errMsgCase is one pinned user-visible error message.
-type errMsgCase struct {
-	name string
-	err  error
-	want string
-}
+// These tests pin the exact rendered text of the CLI's user-visible error
+// messages. The messages are grepped for in CI pipelines and quoted in bug
+// reports, so a reword is a deliberate change, never a refactoring side
+// effect.
+//
+// Every case drives the real function that emits the message and asserts on
+// what it returns. No production format string is restated here: a test that
+// only re-rendered a copied format string would keep passing after the real
+// message changed, which is exactly the regression these tests exist to
+// catch.
 
+// Full 40-hex fingerprints used where a message embeds one.
 const (
 	msgFpA = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
 	msgFpB = "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
 )
 
-func checkErrMsgCases(t *testing.T, cases []errMsgCase) {
+// runLocked runs fn while holding runMu, so operations that write to the
+// process-global logger do not race the other CLI runs.
+func runLocked(fn func() error) error {
+	runMu.Lock()
+	defer runMu.Unlock()
+
+	return fn()
+}
+
+// unsignedChecker builds a Checker over a freshly scanned, unsigned manifest.
+func unsignedChecker(t *testing.T) *mfer.Checker {
 	t.Helper()
 
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			assert.Equal(t, tc.want, tc.err.Error())
-		})
-	}
+	fs := afero.NewMemMapFs()
+	require.NoError(t, fs.MkdirAll("/d", 0o755))
+	require.NoError(t, afero.WriteFile(fs, "/d/f.txt", []byte("hi"), 0o644))
+
+	s := mfer.NewScannerWithOptions(&mfer.ScannerOptions{Fs: fs})
+	require.NoError(t, s.EnumeratePath("/d", nil))
+
+	var buf bytes.Buffer
+
+	require.NoError(t, s.ToManifest(context.Background(), &buf, nil))
+	require.NoError(t, afero.WriteFile(fs, "/d/index.mf", buf.Bytes(), 0o644))
+
+	chk, err := mfer.NewChecker("/d/index.mf", "/d", fs)
+	require.NoError(t, err)
+	require.False(t, chk.IsSigned())
+
+	return chk
 }
 
-// TestErrorMessagesVerbatim pins the exact rendered text of the CLI's
-// user-visible error messages.
+func TestNoManifestFoundMessage(t *testing.T) {
+	t.Parallel()
+
+	_, err := findManifest(afero.NewMemMapFs(), "/tmp/x")
+	require.ErrorIs(t, err, errNoManifestFound)
+	assert.EqualError(t, err,
+		"no manifest found in /tmp/x (looked for index.mf and .index.mf)")
+}
+
+func TestVerifyRequiredSignerMessages(t *testing.T) {
+	t.Parallel()
+
+	t.Run("invalid fingerprint length", func(t *testing.T) {
+		t.Parallel()
+
+		err := verifyRequiredSigner(unsignedChecker(t), "12345678")
+		require.ErrorIs(t, err, errInvalidFingerprint)
+		assert.EqualError(t, err,
+			"invalid fingerprint: must be exactly 40 hex characters, got 8")
+	})
+
+	t.Run("manifest not signed", func(t *testing.T) {
+		t.Parallel()
+
+		err := verifyRequiredSigner(unsignedChecker(t), msgFpA)
+		require.ErrorIs(t, err, errManifestNotSigned)
+		assert.EqualError(t, err,
+			"manifest is not signed, but signature from "+msgFpA+" is required")
+	})
+}
+
+// TestSignerMismatchMessage drives verifyRequiredSigner against a real signed
+// manifest. The embedded fingerprint is whatever the generated key produced,
+// so it is read back from the checker and substituted into the expected
+// string; the required signer is a fixed value that cannot match it. Requires
+// gpg and is skipped where it is absent, as the other signing tests are.
 //
-// These strings are an interface: they are grepped for in CI pipelines
-// and quoted in bug reports. The messages are assembled by wrapping
-// static sentinels, and it is easy to change what a user sees while
-// only meaning to make an error matchable with errors.Is - which is
-// precisely what happened once already. Any change to a string below is
-// therefore a deliberate, separately stated change, never a side effect
-// of a refactor.
-func TestErrorMessagesVerbatim(t *testing.T) {
+//nolint:paralleltest // signedChecker calls t.Setenv, which bars t.Parallel
+func TestSignerMismatchMessage(t *testing.T) {
+	chk := signedChecker(t)
+
+	embeddedFP, err := chk.ExtractEmbeddedSigningKeyFP()
+	require.NoError(t, err)
+
+	err = verifyRequiredSigner(chk, msgFpB)
+	require.ErrorIs(t, err, errSignerMismatch)
+	assert.EqualError(t, err,
+		"embedded signing key fingerprint "+embeddedFP+
+			" does not match required "+msgFpB)
+}
+
+// signedChecker builds a Checker over a manifest signed by a throwaway GPG
+// key generated in a temporary GNUPGHOME.
+func signedChecker(t *testing.T) *mfer.Checker {
+	t.Helper()
+
+	_, err := exec.LookPath("gpg")
+	if err != nil {
+		t.Skip("gpg not installed, skipping signing test")
+	}
+
+	gpgHome := t.TempDir()
+	params := "%no-protection\n" +
+		"Key-Type: RSA\nKey-Length: 2048\n" +
+		"Name-Real: MFER Test Key\nName-Email: test@mfer.test\n" +
+		"Expire-Date: 0\n%commit\n"
+	paramsFile := filepath.Join(gpgHome, "key-params")
+	require.NoError(t, os.WriteFile(paramsFile, []byte(params), 0o600))
+
+	//nolint:gosec // paramsFile is a test-controlled path inside t.TempDir()
+	cmd := exec.CommandContext(context.Background(), "gpg",
+		"--batch", "--gen-key", paramsFile)
+
+	cmd.Env = append(os.Environ(), "GNUPGHOME="+gpgHome)
+
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Skipf("failed to generate test GPG key: %v: %s", err, out)
+	}
+
+	t.Setenv("GNUPGHOME", gpgHome)
+
+	b := mfer.NewBuilder()
+	b.SetSigningOptions(&mfer.SigningOptions{KeyID: mfer.GPGKeyID("test@mfer.test")})
+
+	content := []byte("signed file")
+	_, err = b.AddFile("f.txt", mfer.FileSize(len(content)), mfer.ModTime{},
+		bytes.NewReader(content), nil)
+	require.NoError(t, err)
+
+	var buf bytes.Buffer
+
+	require.NoError(t, b.Build(&buf))
+
+	fs := afero.NewMemMapFs()
+	require.NoError(t, afero.WriteFile(fs, "/index.mf", buf.Bytes(), 0o644))
+
+	chk, err := mfer.NewChecker("/index.mf", "/", fs)
+	require.NoError(t, err)
+	require.True(t, chk.IsSigned())
+
+	return chk
+}
+
+func TestPathDoesNotExistMessage(t *testing.T) {
 	t.Parallel()
 
-	checkErrMsgCases(t, []errMsgCase{
-		{
-			name: "check: no manifest found",
-			err: fmt.Errorf("%w in %s (looked for index.mf and .index.mf)",
-				errNoManifestFound, "/tmp/x"),
-			want: "no manifest found in /tmp/x " +
-				"(looked for index.mf and .index.mf)",
-		},
-		{
-			name: "check: invalid fingerprint length",
-			err:  fmt.Errorf("%w, got %d", errInvalidFingerprint, 8),
-			want: "invalid fingerprint: must be exactly 40 hex characters, got 8",
-		},
-		{
-			name: "check: manifest not signed",
-			err: fmt.Errorf("%w, but signature from %s is required",
-				errManifestNotSigned, msgFpA),
-			want: "manifest is not signed, but signature from " + msgFpA +
-				" is required",
-		},
-		{
-			name: "check: signer mismatch",
-			err: fmt.Errorf("embedded signing key fingerprint %s %w %s",
-				msgFpA, errSignerMismatch, msgFpB),
-			want: "embedded signing key fingerprint " + msgFpA +
-				" does not match required " + msgFpB,
-		},
-		{
-			name: "gen: path does not exist",
-			err:  fmt.Errorf("%w: %s", errPathNotExist, "nope"),
-			want: "path does not exist: nope",
-		},
-		{
-			name: "gen: output file exists",
-			err:  fmt.Errorf("output file %s %w", "index.mf", errOutputExists),
-			want: "output file index.mf already exists " +
-				"(use --force to overwrite)",
-		},
-		{
-			name: "mfer: unknown command",
-			err:  fmt.Errorf("%w %q", errUnknownCommand, "bogus"),
-			want: `unknown command "bogus"`,
-		},
+	set := flag.NewFlagSet("gen", flag.ContinueOnError)
+	require.NoError(t, set.Parse([]string{"nope"}))
+
+	mfa := &CLIApp{Fs: afero.NewMemMapFs()}
+	ctx := urfcli.NewContext(nil, set, nil)
+
+	_, err := mfa.collectInputPaths(ctx.Args())
+	require.ErrorIs(t, err, errPathNotExist)
+	assert.EqualError(t, err, "path does not exist: nope")
+}
+
+func TestOutputFileExistsMessage(t *testing.T) {
+	t.Parallel()
+
+	fs := afero.NewMemMapFs()
+	require.NoError(t, fs.MkdirAll("/d", 0o755))
+	require.NoError(t, afero.WriteFile(fs, "/d/f.txt", []byte("hi"), 0o644))
+	require.NoError(t, afero.WriteFile(fs, "/out.mf", []byte("old"), 0o644))
+
+	set := flag.NewFlagSet("gen", flag.ContinueOnError)
+	set.String("output", "", "")
+	set.Bool("force", false, "")
+	require.NoError(t, set.Parse([]string{"/d"}))
+	require.NoError(t, set.Set("output", "/out.mf"))
+
+	mfa := &CLIApp{Fs: fs}
+	ctx := urfcli.NewContext(nil, set, nil)
+
+	// generateManifestOperation writes to the process-global logger during
+	// enumeration, so serialize with the other CLI runs.
+	err := runLocked(func() error { return mfa.generateManifestOperation(ctx) })
+	require.ErrorIs(t, err, errOutputExists)
+	assert.EqualError(t, err,
+		"output file /out.mf already exists (use --force to overwrite)")
+}
+
+// TestUnknownCommandMessage drives the root command's action. run only logs
+// the error that action returns, so the test lets run build the app with no
+// command given and then runs that same app on an unknown command to get the
+// error itself.
+func TestUnknownCommandMessage(t *testing.T) {
+	t.Parallel()
+
+	mfa := &CLIApp{
+		appname: testApp,
+		Stdout:  &bytes.Buffer{},
+		Stderr:  &bytes.Buffer{},
+		Fs:      afero.NewMemMapFs(),
+	}
+
+	// run points the process-global logger at this app's output, so
+	// serialize with the other CLI runs.
+	err := runLocked(func() error {
+		mfa.run([]string{testApp})
+
+		return mfa.app.Run([]string{testApp, "bogus"})
+	})
+	require.ErrorIs(t, err, errUnknownCommand)
+	assert.EqualError(t, err, `unknown command "bogus"`)
+}
+
+func TestManifestLoaderHTTPStatusMessage(t *testing.T) {
+	t.Parallel()
+
+	server := httptest.NewServer(
+		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusNotFound)
+		}))
+	defer server.Close()
+
+	mfa := &CLIApp{Fs: afero.NewMemMapFs()}
+
+	_, err := mfa.openManifestReader(server.URL + "/foo.mf")
+	require.ErrorIs(t, err, errHTTPStatus)
+	assert.EqualError(t, err,
+		"failed to fetch "+server.URL+"/foo.mf: HTTP 404")
+}
+
+func TestFetchManifestHTTPStatusMessage(t *testing.T) {
+	t.Parallel()
+
+	server := httptest.NewServer(
+		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusNotFound)
+		}))
+	defer server.Close()
+
+	set := flag.NewFlagSet("fetch", flag.ContinueOnError)
+	require.NoError(t, set.Parse([]string{server.URL}))
+
+	mfa := &CLIApp{Fs: afero.NewMemMapFs()}
+	ctx := urfcli.NewContext(nil, set, nil)
+
+	// fetchManifestOperation logs to the process-global logger.
+	err := runLocked(func() error { return mfa.fetchManifestOperation(ctx) })
+	require.ErrorIs(t, err, errHTTPStatus)
+	assert.EqualError(t, err, "failed to fetch manifest: HTTP 404")
+}
+
+func TestFetchFileHTTPStatusMessage(t *testing.T) {
+	t.Parallel()
+
+	server := httptest.NewServer(
+		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusInternalServerError)
+		}))
+	defer server.Close()
+
+	err := downloadFile(context.Background(), server.URL+"/x", "x",
+		&mfer.MFFilePath{}, nil)
+	require.ErrorIs(t, err, errHTTPStatus)
+	assert.EqualError(t, err, "HTTP 500")
+}
+
+func TestURLRequiredMessage(t *testing.T) {
+	t.Parallel()
+
+	set := flag.NewFlagSet("fetch", flag.ContinueOnError)
+	require.NoError(t, set.Parse([]string{}))
+
+	mfa := &CLIApp{Fs: afero.NewMemMapFs()}
+	ctx := urfcli.NewContext(nil, set, nil)
+
+	// fetchManifestOperation logs to the process-global logger.
+	err := runLocked(func() error { return mfa.fetchManifestOperation(ctx) })
+	require.ErrorIs(t, err, errURLRequired)
+	assert.EqualError(t, err, "URL argument required")
+}
+
+func TestSanitizePathMessages(t *testing.T) {
+	t.Parallel()
+
+	t.Run("empty", func(t *testing.T) {
+		t.Parallel()
+
+		_, err := sanitizePath("")
+		require.ErrorIs(t, err, errEmptyPath)
+		assert.EqualError(t, err, "empty path")
+	})
+
+	t.Run("absolute", func(t *testing.T) {
+		t.Parallel()
+
+		_, err := sanitizePath("/etc/passwd")
+		require.ErrorIs(t, err, errAbsolutePath)
+		assert.EqualError(t, err, "absolute path not allowed: /etc/passwd")
+	})
+
+	t.Run("traversal", func(t *testing.T) {
+		t.Parallel()
+
+		_, err := sanitizePath("../x")
+		require.ErrorIs(t, err, errPathTraversal)
+		assert.EqualError(t, err, "path traversal not allowed: ../x")
 	})
 }
 
-// TestFetchErrorMessagesVerbatim pins the fetch and manifest-loader
-// messages; see TestErrorMessagesVerbatim for why.
-func TestFetchErrorMessagesVerbatim(t *testing.T) {
+func TestSizeMismatchMessage(t *testing.T) {
 	t.Parallel()
 
-	checkErrMsgCases(t, []errMsgCase{
-		{
-			name: "manifest_loader: http status",
-			err: fmt.Errorf("failed to fetch %s: %w %d",
-				"https://example.com/index.mf", errHTTPStatus, 404),
-			want: "failed to fetch https://example.com/index.mf: HTTP 404",
-		},
-		{
-			name: "fetch: manifest http status",
-			err: fmt.Errorf("failed to fetch manifest: %w %d",
-				errHTTPStatus, 404),
-			want: "failed to fetch manifest: HTTP 404",
-		},
-		{
-			name: "fetch: file http status",
-			err:  fmt.Errorf("%w %d", errHTTPStatus, 500),
-			want: "HTTP 500",
-		},
-		{
-			name: "fetch: empty path",
-			err:  errEmptyPath,
-			want: "empty path",
-		},
-		{
-			name: "fetch: absolute path",
-			err:  fmt.Errorf("%w: %s", errAbsolutePath, "/etc/passwd"),
-			want: "absolute path not allowed: /etc/passwd",
-		},
-		{
-			name: "fetch: path traversal",
-			err:  fmt.Errorf("%w: %s", errPathTraversal, "../x"),
-			want: "path traversal not allowed: ../x",
-		},
-		{
-			name: "fetch: size mismatch",
-			err: fmt.Errorf("%w: expected %d bytes, got %d",
-				errSizeMismatch, 10, 9),
-			want: "size mismatch: expected 10 bytes, got 9",
-		},
-		{
-			name: "fetch: url required",
-			err:  errURLRequired,
-			want: "URL argument required",
-		},
-		{
-			name: "fetch: hash mismatch",
-			err:  errHashMismatch,
-			want: "hash mismatch",
-		},
-	})
+	// finishDownload returns the size-mismatch error before it touches the
+	// paths, digest, or entry, so those can be zero here.
+	err := finishDownload("", "", 9, 10, nil, nil, nil, nil)
+	require.ErrorIs(t, err, errSizeMismatch)
+	assert.EqualError(t, err, "size mismatch: expected 10 bytes, got 9")
 }
 
-// TestSentinelsAreMatchable checks that the wrapped forms of the
-// messages above remain matchable with errors.Is, which is the reason
-// the sentinels exist at all.
-func TestSentinelsAreMatchable(t *testing.T) {
+func TestHashMismatchMessage(t *testing.T) {
 	t.Parallel()
 
-	wrapped := fmt.Errorf("embedded signing key fingerprint %s %w %s",
-		"a", errSignerMismatch, "b")
-	require.ErrorIs(t, wrapped, errSignerMismatch)
-
-	wrapped = fmt.Errorf("output file %s %w", "index.mf", errOutputExists)
-	require.ErrorIs(t, wrapped, errOutputExists)
-
-	wrapped = fmt.Errorf("failed to fetch manifest: %w %d", errHTTPStatus, 404)
-	require.ErrorIs(t, wrapped, errHTTPStatus)
-
-	assert.NotErrorIs(t, errHashMismatch, errSizeMismatch)
+	// A 32-byte digest that matches none of the (empty) manifest hashes.
+	err := verifyDownloadedHash(make([]byte, 32), &mfer.MFFilePath{})
+	require.ErrorIs(t, err, errHashMismatch)
+	require.NotErrorIs(t, err, errSizeMismatch)
+	assert.EqualError(t, err, "hash mismatch")
 }

internal/cli/freshen_test.go

@@ -110,7 +110,10 @@ func TestFreshenRecordEntryMtimePresence(t *testing.T) {
 
 	const relPath = "file1.txt"
 
-	mtime := time.Unix(1_700_000_000, 0)
+	// The scanned file's mtime is the Unix epoch. If recordEntry ever misreads
+	// an absent manifest mtime as the epoch, the "absent" case below would
+	// compare equal to this and be classified unchanged, so the test fails.
+	mtime := time.Unix(0, 0)
 	info := stubFileInfo{size: 8, mtime: mtime}
 
 	for _, tc := range []struct {

mfer/deserialize.go

@@ -111,11 +111,14 @@ func (m *manifest) verifyOuterIntegrity() error {
 func (m *manifest) decompressInner() ([]byte, error) {
 	bb := bytes.NewBuffer(m.pbOuter.GetInnerMessage())
 
-	// The decoder's own limit is 64 GiB. Up to that it sets aside as many
-	// bytes as a frame header claims, and it decodes a payload under
-	// 128 KiB in full before the LimitReader below reads any of it, so it
-	// needs MaxDecompressedSize as its limit too.
+	// By default the decoder decodes a payload under 128 KiB in full,
+	// each frame up to the decoder's limit, before the LimitReader below
+	// reads any of it. Decoding synchronously and never in full makes it decode
+	// only what the LimitReader asks for. Its limit caps the window that
+	// a frame header can make it set aside.
 	zr, err := zstd.NewReader(bb,
+		zstd.WithDecoderConcurrency(1),
+		zstd.WithDecodeBuffersBelow(0),
 		zstd.WithDecoderMaxMemory(uint64(MaxDecompressedSize)))
 	if err != nil {
 		return nil, fmt.Errorf("deserialize: zstd reader: %w", err)

mfer/deserialize_fuzz_test.go

@@ -5,6 +5,8 @@ import (
 	"bytes"
 	"runtime"
 	"testing"
+
+	"google.golang.org/protobuf/proto"
 )
 
 // FuzzNewManifestFromReader feeds arbitrary bytes to the manifest parser.
@@ -14,8 +16,8 @@ import (
 //
 // For every input the parser must return a manifest or an error, not both
 // and not neither, and must not allocate more than a fixed multiple of its
-// input plus MaxDecompressedSize. A panic or a hang fails the test on its
-// own.
+// input and of the decompressed data it may read, plus room for the
+// decoder's window. A panic or a hang fails the test on its own.
 func FuzzNewManifestFromReader(f *testing.F) {
 	// A signed manifest makes the parser write the key and signature to a
 	// temporary directory and run gpg on them. With gpg off the PATH and
@@ -38,12 +40,31 @@ func FuzzNewManifestFromReader(f *testing.F) {
 			t.Fatalf("got manifest %p and error %v, want exactly one", m, err)
 		}
 
-		// The parser keeps a copy of its input and at most
-		// MaxDecompressedSize bytes of decompressed data. Buffers grow by
-		// copying, so reaching those sizes allocates a few times them in
-		// total. Sixteen times leaves room for that, and none for a
-		// decoder that sets aside whatever size its input claims.
-		limit := 16 * (uint64(len(data)) + uint64(MaxDecompressedSize))
+		// The parser reads at most the declared size plus one byte of
+		// decompressed data, and never more than MaxDecompressedSize.
+		decompressed := uint64(MaxDecompressedSize)
+
+		outer := new(MFFileOuter)
+		if validateMagic(data) &&
+			proto.Unmarshal(data[len(MAGIC):], outer) == nil {
+			size := outer.GetSize()
+			if size > 0 && size < MaxDecompressedSize {
+				decompressed = uint64(size) + 1
+			}
+		}
+
+		// It also keeps a few copies of its input, and the decoder sets
+		// aside a window that a frame header sizes, up to a little over
+		// MaxDecompressedSize. Buffers grow by copying, so reaching those
+		// sizes allocates a few times them in total: sixteen times the
+		// input and the decompressed data, plus twice MaxDecompressedSize
+		// for the window, leaves room for that. The seed whose frame
+		// claims 8 GiB fails if the decoder sets that size aside; the seed
+		// whose two frames together exceed MaxDecompressedSize fails if
+		// the decoder decodes them in full instead of stopping at the
+		// declared size.
+		limit := 16*(uint64(len(data))+decompressed) +
+			2*uint64(MaxDecompressedSize)
 
 		allocated := after.TotalAlloc - before.TotalAlloc
 		if allocated > limit {