{"record":{"id":"d8650cc4cee01bd5","repo":"jdx/mise","slug":"plaintext-exceeds-the-size-limit","errorCode":null,"errorMessage":"plaintext exceeds the size limit","messagePattern":"plaintext exceeds the size limit","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/agecrypt.rs","lineNumber":157,"sourceCode":"    reader.take(limit + 1).read_to_end(&mut bytes)?;\n    if bytes.len() as u64 > limit {\n        return Err(std::io::Error::other(\n            \"encrypted content exceeds the size limit\",\n        ));\n    }\n    Ok(bytes)\n}\n\n/// zstd-compressed, then age-encrypted for `recipients`.\npub(crate) fn encrypt_bytes(\n    plaintext: &[u8],\n    recipients: &[Box<dyn Recipient + Send>],\n) -> Result<Vec<u8>> {\n    if recipients.is_empty() {\n        bail!(\"no age recipients to encrypt for\");\n    }\n    if plaintext.len() as u64 > MAX_PLAINTEXT_BYTES {\n        bail!(\"plaintext exceeds the size limit\");\n    }\n    let compressed = zstd::encode_all(plaintext, ZSTD_COMPRESSION_LEVEL)?;\n    if compressed.len() as u64 > MAX_ENCRYPTED_BYTES {\n        bail!(\"compressed payload exceeds the size limit\");\n    }\n    let encryptor =\n        Encryptor::with_recipients(recipients.iter().map(|r| r.as_ref() as &dyn Recipient))\n            .map_err(|e| eyre!(\"creating the age encryptor: {e}\"))?;\n    let mut out = Vec::new();\n    let mut writer = encryptor.wrap_output(&mut out)?;\n    writer.write_all(&compressed)?;\n    writer.finish()?;\n    if out.len() as u64 > MAX_ENCRYPTED_BYTES {\n        bail!(\"encrypted payload exceeds the size limit\");\n    }\n    Ok(out)\n}\n","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/agecrypt.rs#L139-L175","documentation":"encrypt_bytes in src/agecrypt.rs refuses to encrypt plaintext larger than MAX_PLAINTEXT_BYTES (1 GiB, line 135). The age encryption path plus zstd compression runs in memory, so an unbounded input would balloon RAM usage; the check bails early before any compression or encryption work is done.","triggerScenarios":"Calling encrypt_bytes (directly or via the plugin protocol / software recovery paths) with a plaintext buffer whose len() exceeds 1024*1024*1024 bytes.","commonSituations":"Encrypting a very large file or dump that was read fully into memory; a plugin sending an oversized payload; accidentally encrypting a directory tarball or log archive instead of a small secret.","solutions":["Reduce the plaintext to under 1 GiB before encrypting (split into chunks and encrypt each).","Stream or store the large artifact separately and encrypt only keys/manifests.","If the 1 GiB limit is genuinely too small for your use case, raise MAX_PLAINTEXT_BYTES in src/agecrypt.rs and keep the memory tradeoff in mind."],"exampleFix":"// before\nlet data = std::fs::read(\"huge.bin\")?;\nlet ct = encrypt_bytes(&data, &recipients)?; // bails: plaintext exceeds the size limit\n// after\nlet data = std::fs::read(\"huge.bin\")?;\nassert!(data.len() <= 1024 * 1024 * 1024, \"split huge.bin before encrypting\");\nlet ct = encrypt_bytes(&data, &recipients)?;","handlingStrategy":"validation","validationCode":"const MAX_PLAINTEXT_BYTES: usize = 1024 * 1024 * 1024;\nif data.len() > MAX_PLAINTEXT_BYTES {\n    // split or offload before calling encrypt_bytes\n}\nencrypt_bytes(&data, &recipients)?;","typeGuard":"fn within_plaintext_limit(data: &[u8]) -> bool { data.len() as u64 <= 1024 * 1024 * 1024 }","tryCatchPattern":"match encrypt_bytes(&data, &recipients) {\n    Ok(ct) => use(ct),\n    Err(e) if e.to_string().contains(\"size limit\") => split_and_encrypt_in_chunks(&data, &recipients)?,\n    Err(e) => return Err(e),\n}","preventionTips":["Check plaintext length against the 1 GiB limit before calling encrypt_bytes.","For large artifacts, split into chunks or store out-of-band and encrypt only keys.","Remember zstd runs in memory too — plan headroom for compression buffers."],"tags":["encryption","size-limit","memory"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}