Module reader 

Bounds checking for the regions a package footer describes.

A packed file is untrusted input: the runtime parses one on an end user’s machine, and the packer’s inspection commands parse whatever they are handed. Every offset and size in the footer, and in the blocks the manifest carries, is an attacker-controlled u64.

These checks used to live only in the runtime, so onelf info on a truncated download tried to allocate whatever the footer claimed and aborted. Both sides now validate here, before allocating or seeking.

Functions

block_extent

Absolute file offset of block’s compressed bytes, checked against the payload region footer declares.

block_original_size

Decompressed size of block, rejected when it exceeds any plausible block size.

validate_footer

Check every region footer points at against the real file size.