From 53f2df939ff18027effcd3d27bca84d412048bd6 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Wed, 4 Nov 2026 01:42:34 +0000
Subject: [PATCH] address review: cap the opened handle's length before
 allocating

---
 crates/engine/src/links.rs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/crates/engine/src/links.rs b/crates/engine/src/links.rs
index e4dfb1ed78..da3f0fc904 100644
--- a/crates/engine/src/links.rs
+++ b/crates/engine/src/links.rs
@@ -242,6 +242,10 @@ pub fn read_remote_document(path: &Path) -> Result<Vec<u8>, RemoteDocumentPathEr
     if !meta.is_file() {
         return Err(RemoteDocumentPathError::NotAFile);
     }
+    // the opened handle's own length: a file replaced after the path check must not size the buffer
+    if meta.len() > MAX_REMOTE_DOCUMENT_BYTES {
+        return Err(RemoteDocumentPathError::TooLarge);
+    }
     let mut bytes = Vec::with_capacity(usize::try_from(meta.len()).unwrap_or(0));
     file.take(MAX_REMOTE_DOCUMENT_BYTES.saturating_add(1)).read_to_end(&mut bytes).map_err(|e| RemoteDocumentPathError::Read(e.to_string()))?;
     if u64::try_from(bytes.len()).map_or(true, |n| n > MAX_REMOTE_DOCUMENT_BYTES) {