{"record":{"id":"74d150f78cd0e38e","repo":"jdx/mise","slug":"encrypted-payload-exceeds-the-size-limit","errorCode":null,"errorMessage":"encrypted payload exceeds the size limit","messagePattern":"encrypted payload exceeds the size limit","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/agecrypt.rs","lineNumber":171,"sourceCode":"    if recipients.is_empty() {\n        bail!(\"no age recipients to encrypt for\");\n    }\n    if plaintext.len() as u64 > MAX_PLAINTEXT_BYTES {\n        bail!(\"plaintext exceeds the size limit\");\n    }\n    let compressed = zstd::encode_all(plaintext, ZSTD_COMPRESSION_LEVEL)?;\n    if compressed.len() as u64 > MAX_ENCRYPTED_BYTES {\n        bail!(\"compressed payload exceeds the size limit\");\n    }\n    let encryptor =\n        Encryptor::with_recipients(recipients.iter().map(|r| r.as_ref() as &dyn Recipient))\n            .map_err(|e| eyre!(\"creating the age encryptor: {e}\"))?;\n    let mut out = Vec::new();\n    let mut writer = encryptor.wrap_output(&mut out)?;\n    writer.write_all(&compressed)?;\n    writer.finish()?;\n    if out.len() as u64 > MAX_ENCRYPTED_BYTES {\n        bail!(\"encrypted payload exceeds the size limit\");\n    }\n    Ok(out)\n}\n\npub(crate) async fn decrypt_bytes_mode(\n    ciphertext: &[u8],\n    interactive: bool,\n) -> Result<Vec<u8>, DecryptError> {\n    if ciphertext.len() as u64 > MAX_ENCRYPTED_BYTES {\n        return Err(DecryptError::Corrupt(\n            \"encrypted payload exceeds the size limit\".into(),\n        ));\n    }\n    let loaded = load_identities(interactive).await;\n    if loaded.identities.is_empty() {\n        if loaded.plugins > 0 {\n            return Err(DecryptError::Failed { error: \"hardware identity requires an interactive restore with its age plugin installed\".into(), hint: String::new() });\n        }","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/agecrypt.rs#L153-L189","documentation":"After age-encrypting the compressed data, encrypt_bytes verifies the final ciphertext vector does not exceed MAX_ENCRYPTED_BYTES; age framing adds overhead, so even an acceptable compressed input can yield slightly larger output. If out.len() exceeds the limit the result is discarded and the error is raised.","triggerScenarios":"encrypt_bytes produced ciphertext (compressed payload + age envelope overhead) larger than MAX_ENCRYPTED_BYTES.","commonSituations":"Input near the compressed-size boundary where age header/chunk overhead pushes the total over the limit; incompressible data just under the raw limit.","solutions":["Reduce input size by a margin that accounts for age overhead (headers, chunk framing).","Check out.len() logic: keep input well below MAX_ENCRYPTED_BYTES rather than exactly at it.","Raise MAX_ENCRYPTED_BYTES in src/agecrypt.rs if the limit no longer fits deployment constraints."],"exampleFix":"// before\nlet ct = encrypt_bytes(&data, &recipients)?; // fails at the final size check due to age overhead\n// after\nlet budget = MAX_ENCRYPTED_BYTES - 64 * 1024; // leave headroom for age framing\nassert!((data.len() as u64) <= budget, \"trim data below the encrypted-size budget\");\nlet ct = encrypt_bytes(&data, &recipients)?;","handlingStrategy":"validation","validationCode":"let headroom: u64 = 64 * 1024; // age framing overhead\nif data.len() as u64 > MAX_ENCRYPTED_BYTES - headroom {\n    // trim or split before encrypting\n}\nencrypt_bytes(&data, &recipients)?;","typeGuard":"null","tryCatchPattern":"match encrypt_bytes(&data, &recipients) {\n    Ok(ct) => use(ct),\n    Err(e) if e.to_string().contains(\"encrypted payload exceeds\") => retry_with_smaller_input(),\n    Err(e) => return Err(e),\n}","preventionTips":["Leave headroom for age header/chunk overhead when sizing inputs.","Keep inputs comfortably below MAX_ENCRYPTED_BYTES.","If limits are too tight for your workload, raise them in src/agecrypt.rs deliberately."],"tags":["encryption","size-limit","ciphertext"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}