{"record":{"id":"84c741829ee0e51a","repo":"jdx/mise","slug":"registry-archive-entry-is-too-large","errorCode":null,"errorMessage":"registry archive entry is too large","messagePattern":"registry archive entry is too large","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/registry.rs","lineNumber":376,"sourceCode":"    }\n\n    ensure!(\n        !sources.is_empty(),\n        \"archive does not contain registry entries\"\n    );\n    registry_from_sources(sources)\n}\n\nfn track_registry_archive_entry(\n    index: usize,\n    entry_size: u64,\n    archive_size: &mut u64,\n) -> Result<()> {\n    ensure!(\n        index < MAX_REGISTRY_ARCHIVE_ENTRIES,\n        \"registry archive contains too many entries\"\n    );\n    ensure!(\n        entry_size <= MAX_REGISTRY_ARCHIVE_ENTRY_SIZE,\n        \"registry archive entry is too large\"\n    );\n    *archive_size = archive_size\n        .checked_add(entry_size)\n        .ok_or_else(|| eyre::eyre!(\"registry archive size overflow\"))?;\n    ensure!(\n        *archive_size <= MAX_REGISTRY_ARCHIVE_SIZE,\n        \"registry archive is too large\"\n    );\n    Ok(())\n}\n\nfn registry_from_sources(sources: BTreeMap<String, String>) -> Result<Registry> {\n    let mut entries = BTreeMap::new();\n    let mut missing_version_order = false;\n    for (short, source) in sources {\n        let value: toml::Value = toml::from_str(&source)","sourceCodeStart":358,"sourceCodeEnd":394,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/registry.rs#L358-L394","documentation":"While tracking registry archive entries, mise checks each entry's declared size against MAX_REGISTRY_ARCHIVE_ENTRY_SIZE. A single entry larger than this cap is rejected — another decompression-bomb guard so one huge registry file cannot exhaust memory when read into a String.","triggerScenarios":"parse_registry_archive encountering a single archive entry whose uncompressed size exceeds MAX_REGISTRY_ARCHIVE_ENTRY_SIZE.","commonSituations":"A malicious registry archive with one massive entry, a corrupted download reporting wrong sizes, or a publisher accidentally embedding a large vendored blob (lockfile dump, binary asset) in the registry.","solutions":["Re-download the registry archive from the official source; a corrupted or tampered file is the usual cause.","List entry sizes (`tar -tvzf archive.tar.gz`) to find the oversized entry and remove it from the packaging input if you publish the registry.","Split legitimately huge registry content into multiple smaller entry files instead of one giant file."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# shell: find entries above a per-file size bound before parsing\ntar -tvzf registry.tar.gz | awk '$3 > 10485760 {print $NF, $3}'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep each registry entry file small; split large data across multiple entries.","Never embed vendored blobs or binaries inside registry archives.","Verify archive integrity (checksums/signatures) before parsing untrusted downloads."],"tags":["security","archive","resource-limit","registry"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}