{"record":{"id":"dafb4181a2339367","repo":"jdx/mise","slug":"compressed-payload-exceeds-the-size-limit","errorCode":null,"errorMessage":"compressed payload exceeds the size limit","messagePattern":"compressed payload exceeds the size limit","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/agecrypt.rs","lineNumber":161,"sourceCode":"        ));\n    }\n    Ok(bytes)\n}\n\n/// zstd-compressed, then age-encrypted for `recipients`.\npub(crate) fn encrypt_bytes(\n    plaintext: &[u8],\n    recipients: &[Box<dyn Recipient + Send>],\n) -> Result<Vec<u8>> {\n    if recipients.is_empty() {\n        bail!(\"no age recipients to encrypt for\");\n    }\n    if plaintext.len() as u64 > MAX_PLAINTEXT_BYTES {\n        bail!(\"plaintext exceeds the size limit\");\n    }\n    let compressed = zstd::encode_all(plaintext, ZSTD_COMPRESSION_LEVEL)?;\n    if compressed.len() as u64 > MAX_ENCRYPTED_BYTES {\n        bail!(\"compressed payload exceeds the size limit\");\n    }\n    let encryptor =\n        Encryptor::with_recipients(recipients.iter().map(|r| r.as_ref() as &dyn Recipient))\n            .map_err(|e| eyre!(\"creating the age encryptor: {e}\"))?;\n    let mut out = Vec::new();\n    let mut writer = encryptor.wrap_output(&mut out)?;\n    writer.write_all(&compressed)?;\n    writer.finish()?;\n    if out.len() as u64 > MAX_ENCRYPTED_BYTES {\n        bail!(\"encrypted payload exceeds the size limit\");\n    }\n    Ok(out)\n}\n\npub(crate) async fn decrypt_bytes_mode(\n    ciphertext: &[u8],\n    interactive: bool,\n) -> Result<Vec<u8>, DecryptError> {","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/agecrypt.rs#L143-L179","documentation":"After zstd-compressing the plaintext, encrypt_bytes checks that the compressed buffer is at most MAX_ENCRYPTED_BYTES; if not, it bails before creating the age encryptor. This bounds the size of the payload that will be handed to age and later stored/transmitted.","triggerScenarios":"encrypt_bytes is called with input whose zstd-compressed form (at ZSTD_COMPRESSION_LEVEL) is larger than MAX_ENCRYPTED_BYTES — typically already-compressed, incompressible data near or above the limit.","commonSituations":"Encrypting large binary blobs, media files, or already-compressed archives that zstd cannot shrink; oversized plugin protocol payloads.","solutions":["Shrink or split the input so the compressed payload fits the limit.","Pre-check the compressed size yourself with zstd::encode_all before calling, to fail with a better message.","Store large payloads out-of-band (e.g. object storage) and encrypt only a reference/key."],"exampleFix":"// before\nlet ct = encrypt_bytes(&blob, &recipients)?; // bails: compressed payload exceeds the size limit\n// after\nlet compressed_len = zstd::encode_all(&blob[..], 0)?.len();\nassert!(compressed_len as u64 <= MAX_ENCRYPTED_BYTES, \"split blob before encrypting\");\nlet ct = encrypt_bytes(&blob, &recipients)?;","handlingStrategy":"validation","validationCode":"let compressed = zstd::encode_all(&data[..], 0)?;\nassert!(compressed.len() as u64 <= MAX_ENCRYPTED_BYTES, \"compressed payload too large; split input\");\nencrypt_bytes(&data, &recipients)?;","typeGuard":"fn compressed_fits(data: &[u8]) -> bool {\n    zstd::encode_all(data, 0).map(|c| c.len() as u64 <= 1024u64*1024*1024).unwrap_or(false)\n}","tryCatchPattern":"match encrypt_bytes(&data, &recipients) {\n    Ok(ct) => use(ct),\n    Err(e) if e.to_string().contains(\"compressed payload exceeds\") => eprintln!(\"split or store the blob out-of-band\"),\n    Err(e) => return Err(e),\n}","preventionTips":["Pre-compress to verify the payload fits the limit for incompressible data.","Keep inputs well below the limit, not at it.","Avoid encrypting media/already-compressed archives in one blob."],"tags":["encryption","compression","size-limit"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}