From abb89376df792e31c93f7aa72e60faa8a7dcfea6 Mon Sep 17 00:00:00 2001 From: Tingmao Wang Date: Mon, 22 Jun 2026 17:10:02 +0100 Subject: [PATCH] gcs-sidecar/bridge: Do not enforce MaxMsgSize on incoming messages This was discovered as causing the UVM to crash when we try to load a long fragment. Currently, the LCOW gcs does not enforce this limit, and so we never hit this in LCOW. I think it should be fine to also not enforce it for WCOW, since DoS attack from the host is outside the scope of the confidential threat model, and this avoid arbitrary length limits on policy and fragments. Signed-off-by: Tingmao Wang --- internal/gcs-sidecar/bridge.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/internal/gcs-sidecar/bridge.go b/internal/gcs-sidecar/bridge.go index 1923ee3ded..1f92af7b7c 100644 --- a/internal/gcs-sidecar/bridge.go +++ b/internal/gcs-sidecar/bridge.go @@ -191,7 +191,9 @@ func readMessage(r io.Reader) (messageHeader, []byte, error) { } n := header.Size - if n < prot.HdrSize || n > prot.MaxMsgSize { + // Deliberately don't enforce MaxMsgSize here. This follows what the LCOW + // gcs does, and allows us to inject long fragments. + if n < prot.HdrSize { logrus.Errorf("invalid message size %d", n) return messageHeader{}, nil, fmt.Errorf("invalid message size %d: %w", n, err) }