pub const MAX_COVERAGE_BYTES: usize = _ /* 200usize */;Expand description
Upper bound, in bytes, on a Coverage bitmap decoded from untrusted wire.
A well-formed bitmap for a MAX_DISCOVERABLE_BLOB_BYTES blob is this many
bytes: bit-packed at 8 blocks per byte over the fixed 64 MiB
DISCOVERY_BLOCK_BYTES (never the test-support overridable size, so the
bound is a stable security constant). A frame whose Coverage is longer
names more discovery blocks than a 100 GiB blob spans — beyond what
partial-holder discovery represents — and is rejected at decode. This is a
wire representability bound, not a serving cap: a node may still be
configured to hold and serve a larger blob, it just cannot advertise partial
coverage for one over the DHT.
Without this cap a bonded publisher could pin arbitrary receiver memory: coverage length is otherwise bounded only by the 16 MiB frame, and the per-publisher record quota multiplies it (stored memory ≈ records × bitmap). The cap makes an oversized bitmap unrepresentable rather than defended after the fact. For 100 GiB it is 200 bytes.