fix(bounds): .take(LIMIT) on external-input reads (batch 1/N)

Self-scan found 14 UnboundedAllocation criticals in panic-attack's
own src/ — all TPs by detector semantics. This batch bounds the
three highest-risk reads (external or user-supplied input, biggest
attack surface) using the same pattern applied to 007-lang:

  bridge/reachability.rs  — Rust source file scan (64 MiB cap)
  bridge/intelligence.rs  — OSV API HTTP response body (256 MiB for
                            success, 64 KiB for error-body; uses
                            ureq v3's Body::with_config().limit())
  amuck/mod.rs            — mutation target source (64 MiB cap) and
                            spec JSON/YAML (4 MiB cap)

Self-scan after this batch: UnboundedAllocation 14 -> 11 critical
findings (confirmed the three flagged files are now disarmed).
Remaining 11: self-produced reports, config files, /proc metadata,
and the analyzer's own manifest-file reads — all lower-risk but
still on the sweep list for the next batch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

src/amuck/mod.rs

@@ -4,11 +4,22 @@
 
 use anyhow::{anyhow, Context, Result};
 use serde::{Deserialize, Serialize};
-use std::fs;
+use std::fs::{self, File};
+use std::io::Read;
 use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};
 use std::time::Instant;
 
+/// Upper bound on mutation-target source file reads. Amuck operates on a
+/// single source file at a time; 64 MiB is well beyond any realistic
+/// target and prevents a hostile or runaway input from exhausting memory.
+const TARGET_SOURCE_READ_LIMIT: u64 = 64 * 1024 * 1024;
+
+/// Upper bound on mutation spec JSON/YAML reads. Specs are curated,
+/// short documents — 4 MiB is two orders of magnitude beyond realistic
+/// spec size and still catches a malformed or hostile config.
+const SPEC_FILE_READ_LIMIT: u64 = 4 * 1024 * 1024;
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum AmuckPreset {
     Light,
@@ -114,9 +125,18 @@ pub fn run(config: AmuckConfig) -> Result<AmuckReport> {
         ));
     }
 
-    // Source text is loaded once and each combo is applied from the pristine baseline.
-    let source = fs::read_to_string(&config.target)
-        .with_context(|| format!("reading target file {}", config.target.display()))?;
+    // Source text is loaded once and each combo is applied from the pristine
+    // baseline. Cap to TARGET_SOURCE_READ_LIMIT — a larger file is truncated
+    // rather than swallowed whole, and mutations apply to that prefix only.
+    let source = {
+        let mut buf = String::new();
+        File::open(&config.target)
+            .with_context(|| format!("opening target file {}", config.target.display()))?
+            .take(TARGET_SOURCE_READ_LIMIT)
+            .read_to_string(&mut buf)
+            .with_context(|| format!("reading target file {}", config.target.display()))?;
+        buf
+    };
 
     let mut combos = if let Some(spec_path) = &config.spec_path {
         let spec = load_spec(spec_path)?;
@@ -281,8 +301,16 @@ fn mutation_path(target: &Path, output_dir: &Path, id: usize) -> PathBuf {
 }
 
 fn load_spec(path: &Path) -> Result<MutationSpecFile> {
-    let content =
-        fs::read_to_string(path).with_context(|| format!("reading spec {}", path.display()))?;
+    // Cap spec reads at SPEC_FILE_READ_LIMIT — specs are short curated docs.
+    let content = {
+        let mut buf = String::new();
+        File::open(path)
+            .with_context(|| format!("opening spec {}", path.display()))?
+            .take(SPEC_FILE_READ_LIMIT)
+            .read_to_string(&mut buf)
+            .with_context(|| format!("reading spec {}", path.display()))?;
+        buf
+    };
     let spec =
         match path.extension().and_then(|ext| ext.to_str()) {
             Some("json") => serde_json::from_str(&content)

src/bridge/intelligence.rs

@@ -143,11 +143,26 @@ pub fn query_osv_batch(deps: &[LockedDependency]) -> Result<Vec<Vulnerability>>
 
         let status = resp.status().as_u16();
         if !(200..300).contains(&status) {
-            let buf = resp.body_mut().read_to_string().unwrap_or_default();
+            // Cap error-body reads at 64 KiB — for error paths we only
+            // need enough context to report, not the full OSV error blob.
+            let buf = resp
+                .body_mut()
+                .with_config()
+                .limit(64 * 1024)
+                .read_to_string()
+                .unwrap_or_default();
             anyhow::bail!("OSV API returned HTTP {}: {}", status, buf);
         }
 
-        let response_text = resp.body_mut().read_to_string()?;
+        // Cap success-body reads at 256 MiB. OSV batch responses for
+        // ~1000-dep projects run a few MiB at most; 256 MiB is an order
+        // of magnitude beyond any realistic response and prevents a
+        // misbehaving or hostile OSV endpoint from exhausting memory.
+        let response_text = resp
+            .body_mut()
+            .with_config()
+            .limit(256 * 1024 * 1024)
+            .read_to_string()?;
         let response: OsvBatchResponse = serde_json::from_str(&response_text)?;
 
         // Map OSV results back to dependencies

src/bridge/reachability.rs

@@ -11,9 +11,17 @@
 
 use super::{ImportSite, ReachabilityEvidence, ReachabilityStatus};
 use anyhow::Result;
+use std::fs::File;
+use std::io::Read;
 use std::path::Path;
 use walkdir::WalkDir;
 
+/// Upper bound on single-file reads during reachability scans.
+/// Rust source files are almost always well under 16 MiB; capping at 64 MiB
+/// prevents a pathological or malicious input (e.g. a minified vendor blob
+/// masquerading as .rs) from exhausting memory during a mass-panic sweep.
+const SOURCE_FILE_READ_LIMIT: u64 = 64 * 1024 * 1024;
+
 /// Check whether a crate is actually imported in the project's Rust source files.
 ///
 /// Scans all .rs files under `project_dir` for patterns that indicate the
@@ -50,8 +58,17 @@ pub fn check_reachability(project_dir: &Path, crate_name: &str) -> Result<Reacha
             continue;
         }
 
-        // Read file and scan for import patterns
-        let content = match std::fs::read_to_string(path) {
+        // Read file and scan for import patterns. Cap per-file size to
+        // avoid an arbitrarily-large file consuming memory; take(N) is
+        // an upper bound, not a guarantee the file is <= N bytes — if a
+        // file is larger we silently truncate to the first N bytes and
+        // scan that prefix (imports live at the top of a Rust file).
+        let content = match File::open(path).and_then(|f| {
+            let mut buf = String::new();
+            f.take(SOURCE_FILE_READ_LIMIT)
+                .read_to_string(&mut buf)
+                .map(|_| buf)
+        }) {
             Ok(c) => c,
             Err(_) => continue, // Skip unreadable files (binary, encoding issues)
         };