ddidderr/lanspread
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(peer): bound aggregate launch-settings reads

Browse Source 
Charge every SmartSteamEmu.ini chunk to one 64 MiB aggregate budget and the existing ten-minute scan clock. All candidate reads still finish before the first write, so exhaustion cannot leave partial settings or a completion marker.

Test Plan:
- just test
- just clippy
- aggregate-read zero-partial-write regression
- git diff --check
This commit is contained in:
ddidderr
2026-09-12 13:35:36 +02:00
parent eda006c66d
commit 3450d27742
1 changed files with 106 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/lanspread-peer/src/launch_settings.rs
+101 -8
View File
@@ -37,6 +37,7 @@ const DEFAULT_STREAM_INSTALL_NAME: &str = "Commander";
const DEFAULT_STREAM_INSTALL_LANGUAGE: &str = "english";
const MAX_STREAM_INSTALL_NAME_CHARS: usize = 24;
const MAX_LAUNCH_SETTINGS_FILE_BYTES: u64 = 1024 * 1024;
const MAX_LAUNCH_SETTINGS_TOTAL_READ_BYTES: u64 = 64 * 1024 * 1024;
const MAX_LAUNCH_SETTINGS_ENTRIES: usize = MAX_CATALOG_ENTRIES;
const MAX_LAUNCH_SETTINGS_DEPTH: usize = MAX_CATALOG_PATH_BYTES.div_ceil(2);
const MAX_LAUNCH_SETTINGS_SCAN_DURATION: Duration = Duration::from_mins(10);
@@ -45,6 +46,7 @@ const MAX_LAUNCH_SETTINGS_SCAN_DURATION: Duration = Duration::from_mins(10);
struct SearchLimits {
entry_cap: usize,
depth_ceiling: usize,
read_byte_ceiling: u64,
time_budget: Duration,
}
@@ -52,6 +54,7 @@ impl SearchLimits {
const PRODUCTION: Self = Self {
entry_cap: MAX_LAUNCH_SETTINGS_ENTRIES,
depth_ceiling: MAX_LAUNCH_SETTINGS_DEPTH,
read_byte_ceiling: MAX_LAUNCH_SETTINGS_TOTAL_READ_BYTES,
time_budget: MAX_LAUNCH_SETTINGS_SCAN_DURATION,
};
}
@@ -59,6 +62,7 @@ impl SearchLimits {
struct SearchBudget {
limits: SearchLimits,
entries: usize,
bytes_read: u64,
started: Instant,
}
@@ -67,6 +71,7 @@ impl SearchBudget {
Self {
limits,
entries: 0,
bytes_read: 0,
started: Instant::now(),
}
}
@@ -88,6 +93,26 @@ impl SearchBudget {
self.limits.depth_ceiling
);
}
self.ensure_time_budget()
}
fn charge_read(&mut self, bytes: usize) -> eyre::Result<()> {
let bytes = u64::try_from(bytes)
.map_err(|error| eyre::eyre!("launch-settings read size does not fit u64: {error}"))?;
self.bytes_read = self
.bytes_read
.checked_add(bytes)
.ok_or_else(|| eyre::eyre!("launch-settings aggregate read size overflow"))?;
if self.bytes_read > self.limits.read_byte_ceiling {
eyre::bail!(
"launch-settings inputs exceed the {}-byte aggregate read budget",
self.limits.read_byte_ceiling
);
}
self.ensure_time_budget()
}
fn ensure_time_budget(&self) -> eyre::Result<()> {
if self.started.elapsed() >= self.limits.time_budget {
eyre::bail!(
"launch-settings search exceeds the {:?} scan-time budget",
@@ -271,11 +296,27 @@ fn apply_launch_settings_to_tree_blocking(
account_name: Option<&str>,
language: Option<&str>,
persona_name: Option<&str>,
) -> eyre::Result<LaunchSettingsOutcome> {
apply_launch_settings_to_tree_with_limits(
local_root,
account_name,
language,
persona_name,
SearchLimits::PRODUCTION,
)
}
fn apply_launch_settings_to_tree_with_limits(
local_root: &Path,
account_name: Option<&str>,
language: Option<&str>,
persona_name: Option<&str>,
limits: SearchLimits,
) -> eyre::Result<LaunchSettingsOutcome> {
if account_name.is_none() && language.is_none() && persona_name.is_none() {
return Ok(LaunchSettingsOutcome::default());
}
let mut budget = SearchBudget::new(SearchLimits::PRODUCTION);
let mut budget = SearchBudget::new(limits);
let SettingsCandidates {
account_names,
languages,
@@ -286,11 +327,12 @@ fn apply_launch_settings_to_tree_blocking(
let persona_update = if let Some(persona_name) = persona_name {
let mut update = None;
for path in persona_files {
let content = read_bounded_settings_file(&path)?;
let content = read_bounded_settings_file(&path, &mut budget)?;
if let Some(rewritten) = rewrite_persona_name_content(&content, persona_name) {
update = Some((path, rewritten));
break;
}
budget.ensure_time_budget()?;
}
update
} else {
@@ -380,7 +422,7 @@ fn find_settings_candidates(
Ok(candidates)
}
fn read_bounded_settings_file(path: &Path) -> eyre::Result<String> {
fn read_bounded_settings_file(path: &Path, budget: &mut SearchBudget) -> eyre::Result<String> {
let metadata = std::fs::symlink_metadata(path)
.wrap_err_with(|| format!("failed to inspect {}", path.display()))?;
if !metadata.is_file() || metadata.file_type().is_symlink() {
@@ -398,17 +440,34 @@ fn read_bounded_settings_file(path: &Path) -> eyre::Result<String> {
let file =
std::fs::File::open(path).wrap_err_with(|| format!("failed to read {}", path.display()))?;
let mut content = String::new();
file.take(MAX_LAUNCH_SETTINGS_FILE_BYTES + 1)
.read_to_string(&mut content)
let mut reader = file.take(MAX_LAUNCH_SETTINGS_FILE_BYTES + 1);
let mut bytes = Vec::new();
let mut chunk = vec![0_u8; 64 * 1024];
loop {
budget.ensure_time_budget()?;
let read = reader
.read(&mut chunk)
.wrap_err_with(|| format!("failed to read {}", path.display()))?;
if u64::try_from(content.len()).unwrap_or(u64::MAX) > MAX_LAUNCH_SETTINGS_FILE_BYTES {
if read == 0 {
break;
}
budget.charge_read(read)?;
if bytes.len().saturating_add(read)
> usize::try_from(MAX_LAUNCH_SETTINGS_FILE_BYTES).unwrap_or(usize::MAX)
{
eyre::bail!(
"launch-settings input exceeds the {MAX_LAUNCH_SETTINGS_FILE_BYTES}-byte limit: {}",
path.display()
);
}
Ok(content)
bytes.extend_from_slice(&chunk[..read]);
}
String::from_utf8(bytes).wrap_err_with(|| {
format!(
"launch-settings input is not valid UTF-8: {}",
path.display()
)
})
}
/// Rewrite the first `PersonaName` line in `content`, preserving its line ending.
@@ -827,6 +886,7 @@ mod tests {
let mut entry_budget = SearchBudget::new(SearchLimits {
entry_cap: 1,
depth_ceiling: MAX_LAUNCH_SETTINGS_DEPTH,
read_byte_ceiling: MAX_LAUNCH_SETTINGS_TOTAL_READ_BYTES,
time_budget: MAX_LAUNCH_SETTINGS_SCAN_DURATION,
});
let entry_error = find_settings_candidates(tree.path(), &mut entry_budget)
@@ -836,6 +896,7 @@ mod tests {
let mut depth_budget = SearchBudget::new(SearchLimits {
entry_cap: 16,
depth_ceiling: 1,
read_byte_ceiling: MAX_LAUNCH_SETTINGS_TOTAL_READ_BYTES,
time_budget: MAX_LAUNCH_SETTINGS_SCAN_DURATION,
});
let depth_error = find_settings_candidates(tree.path(), &mut depth_budget)
@@ -843,6 +904,38 @@ mod tests {
assert!(depth_error.to_string().contains("depth budget"));
}
#[test]
fn aggregate_ini_read_budget_fails_before_any_settings_write() {
let tree = TempDir::new("lanspread-launch-read-budget");
let account = tree.path().join(ACCOUNT_NAME_FILE);
let first = tree.path().join("a").join(SMART_STEAM_EMU_INI);
let second = tree.path().join("b").join(SMART_STEAM_EMU_INI);
write_file(&account, b"original-account");
write_file(&first, b"Language=english\n");
write_file(&second, b"Language=german\n");
let error = apply_launch_settings_to_tree_with_limits(
tree.path(),
Some("replacement"),
None,
Some("player"),
SearchLimits {
entry_cap: 16,
depth_ceiling: MAX_LAUNCH_SETTINGS_DEPTH,
read_byte_ceiling: 20,
time_budget: MAX_LAUNCH_SETTINGS_SCAN_DURATION,
},
)
.expect_err("multiple bounded INI files must share one aggregate budget");
assert!(error.to_string().contains("aggregate read budget"));
assert_eq!(
std::fs::read_to_string(account).expect("account file should remain readable"),
"original-account",
"all candidate reads must finish before the first settings write"
);
}
fn write_file(path: &Path, bytes: &[u8]) {
if let Some(parent) = path.parent() {
std::fs::create_dir_all(parent).expect("parent dir should be created");