{"record":{"id":"449bb45fff5354cf","repo":"schollz/croc","slug":"received-a-file-position-that-is-too-large","errorCode":null,"errorMessage":"Received a file position that is too large","messagePattern":"Received a file position that is too large","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"web/src/protocol/client.ts","lineNumber":593,"sourceCode":"    this.fail(new Error(\"Data receiver stopped\"));\n  }\n\n  private async read(socket: CrocSocket) {\n    const engine = wasm();\n    while (!this.stopped) {\n      try {\n        let payload = await engine.decrypt(await socket.receive(), this.key);\n        if (!this.noCompress) {\n          payload = await engine.decompress(payload, MAX_DECOMPRESSED_CHUNK_SIZE);\n        }\n        if (payload.byteLength < 9) throw new Error(\"Received an invalid file chunk\");\n        const positionBig = new DataView(\n          payload.buffer,\n          payload.byteOffset,\n          payload.byteLength,\n        ).getBigUint64(0, true);\n        if (positionBig > BigInt(Number.MAX_SAFE_INTEGER)) {\n          throw new Error(\"Received a file position that is too large\");\n        }\n        const position = Number(positionBig);\n        const bytes = payload.slice(8);\n        await this.accept(position, bytes);\n      } catch (error) {\n        if (this.stopped) return;\n        this.stopped = true;\n        this.fail(error instanceof Error ? error : new Error(String(error)));\n      }\n    }\n  }\n\n  private fail(error: Error) {\n    this.failure ??= error;\n    this.active?.reject(error);\n    this.active = undefined;\n  }\n","sourceCodeStart":575,"sourceCodeEnd":611,"githubUrl":"https://github.com/schollz/croc/blob/e25f1bdc04f07f094d50b0a1bf67e2563944b57a/web/src/protocol/client.ts#L575-L611","documentation":"Thrown by DataReceiver.read when the 8-byte little-endian position prefix of a chunk exceeds Number.MAX_SAFE_INTEGER (2^53-1). Positions must map to safe JavaScript numbers for offset math, so a larger value cannot be a legitimate file offset (it would imply an exabyte-scale file). It indicates a corrupted frame or a hostile/buggy sender.","triggerScenarios":"Corrupted plaintext after decrypt/decompress where the first 8 bytes decode to a huge uint64; sender writes an unaligned or wrong-endian position; malicious peer deliberately crafting positions above 2^53; decompression bomb or misinterpretation of a non-chunk payload as a chunk.","commonSituations":"Wasm compress/decompress skew between peer builds; wrong decryption key producing plausible-length garbage; fuzzing or adversarial testing of the data channel; a modified sender that changes the position encoding.","solutions":["Reproduce with the same file and code phrase to distinguish transient corruption from deterministic encoding bugs","Verify sender and recipient wasm builds match (same engine for setBigUint64 little-endian framing)","Run the transfer over a different relay/network to rule out path corruption","If interoperating with external clients, confirm they use the same 8-byte LE position framing"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (!Number.isSafeInteger(file.size) || file.size > Number.MAX_SAFE_INTEGER) {\n  throw new Error(`File too large to transfer: ${file.name}`);\n}","typeGuard":"function isSafeChunkPosition(positionBig: bigint): boolean {\n  return positionBig >= 0n && positionBig <= BigInt(Number.MAX_SAFE_INTEGER);\n}","tryCatchPattern":"catch (e) {\n  if (e instanceof Error && e.message === \"Received a file position that is too large\") {\n    // corrupted or hostile chunk: abort transfer, do not retry the same session\n  }\n  throw e;\n}","preventionTips":["Reject files above Number.MAX_SAFE_INTEGER bytes before starting (prepareFiles already errors on unsafe sizes)","Keep the position encoding identical on both peers: 64-bit little-endian BigUint64","Treat oversized-position errors as corruption signals and restart with a fresh code phrase"],"tags":["data-integrity","receiver","corruption"],"backgroundTag":null,"analyzedSha":"e25f1bdc04f07f094d50b0a1bf67e2563944b57a","analyzedAt":"2026-08-15T12:53:39.096Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}