{"record":{"id":"6e8d395578af9047","repo":"astrid-runtime/astrid","slug":"fskit-service-launch-exceeds-limit","errorCode":null,"errorMessage":"FSKit service launch exceeds limit","messagePattern":"FSKit service launch exceeds limit","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-storage-provider-fskit/src/service.rs","lineNumber":118,"sourceCode":"            return match result {\n                Ok(()) => Err(unmount_error),\n                Err(primary) => Err(primary.context(unmount_error)),\n            };\n        }\n    }\n    let _ = local_transport::remove_endpoint(&launch.control_path);\n    result\n}\n\nfn read_launch() -> Result<StorageProviderServiceLaunchV1> {\n    let mut bytes = Vec::new();\n    std::io::stdin()\n        .lock()\n        .take(MAX_LAUNCH_BYTES + 1)\n        .read_to_end(&mut bytes)\n        .context(\"read FSKit service launch\")?;\n    if bytes.len() as u64 > MAX_LAUNCH_BYTES {\n        bail!(\"FSKit service launch exceeds limit\");\n    }\n    serde_json::from_slice(&bytes).context(\"decode FSKit service launch\")\n}\n\nfn validate_launch(launch: &StorageProviderServiceLaunchV1) -> Result<()> {\n    if launch.schema != STORAGE_FILESYSTEM_SERVICE_LAUNCH_SCHEMA_V1 {\n        bail!(\"unsupported FSKit service launch schema {}\", launch.schema);\n    }\n    validate_launch_parent(&launch.parent)?;\n    validate_lease(&launch.lease)?;\n    crate::validate_mountpoint_layout(&launch.mountpoint)?;\n    if launch.mountpoint == launch.lease.resource_path\n        || launch.mountpoint.starts_with(&launch.lease.resource_path)\n        || launch.lease.resource_path.starts_with(&launch.mountpoint)\n    {\n        bail!(\"FSKit service mountpoint overlaps the lease resource\");\n    }\n    crate::validate_mountpoint_ancestors(&launch.mountpoint)?;","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-storage-provider-fskit/src/service.rs#L100-L136","documentation":"read_launch reads the JSON launch payload from stdin but caps it at MAX_LAUNCH_BYTES by reading one extra byte; if more than MAX_LAUNCH_BYTES bytes arrive it bails instead of decoding. This protects the privileged service from unbounded or hostile stdin payloads.","triggerScenarios":"The parent writes a launch payload larger than MAX_LAUNCH_BYTES (e.g. huge resource/callback paths or embedded data) to the service's stdin; a broken/buggy parent streams garbage or an oversized document.","commonSituations":"Embedding very long paths, tokens, or blobs inside the launch JSON; a corrupted pipe delivering leftover data; older parent version writing an extended schema with extra fields.","solutions":["Reduce the launch payload below MAX_LAUNCH_BYTES (shorten paths, move large data to files referenced by path)","Check the parent version against the service version and upgrade so both agree on payload size limits","Inspect what the parent actually writes to stdin (log the byte count) and fix the oversized field"],"exampleFix":"// before\nlaunch.note = huge_debug_blob; // inflates JSON past MAX_LAUNCH_BYTES\n// after\nlaunch.note = \"diagnostics written to /tmp/launch-notes.txt\";","handlingStrategy":"validation","validationCode":"let payload = serde_json::to_vec(&launch)?;\nanyhow::ensure!(\n    (payload.len() as u64) <= MAX_LAUNCH_BYTES,\n    \"launch payload {} bytes exceeds limit {}\",\n    payload.len(),\n    MAX_LAUNCH_BYTES\n);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep launch payloads small; reference large data by file path","Serialize and size-check the payload in the parent before writing stdin","Keep parent and service versions aligned on MAX_LAUNCH_BYTES","Log payload sizes when debugging launch failures"],"tags":["ipc","payload-size","fskit","input-validation"],"backgroundTag":"payload-too-large","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}