Limit symlink targets to 1024 bytes (XFS_SYMLINK_MAXLEN)

XFS limits symlink targets to 1024 bytes, and since generic Linux
containers are commonly backed by XFS, enforce that limit in both
the dumpfile parser and the EROFS reader rather than allowing up to
PATH_MAX (4096).

This also avoids exercising a known limitation in our EROFS reader
where symlink data that spills into a non-inline data block (which
can happen with long symlinks + xattrs) is not read back correctly.
See composefs/composefs#342 for the
corresponding C fix for that edge case.

Assisted-by: OpenCode (Claude Opus 4)
Signed-off-by: Colin Walters <walters@verbum.org>

Author: cgwalters

crates/composefs/src/dumpfile_parse.rs

@@ -24,6 +24,7 @@ use crate::MAX_INLINE_CONTENT;
 
 /// https://github.com/torvalds/linux/blob/47ac09b91befbb6a235ab620c32af719f8208399/include/uapi/linux/limits.h#L13
 const PATH_MAX: u32 = 4096;
+use crate::SYMLINK_MAX;
 /// https://github.com/torvalds/linux/blob/47ac09b91befbb6a235ab620c32af719f8208399/include/uapi/linux/limits.h#L15
 /// This isn't exposed in libc/rustix, and in any case we should be conservative...if this ever
 /// gets bumped it'd be a hazard.
@@ -456,8 +457,10 @@ impl<'p> Entry<'p> {
                     let target =
                         unescape_to_path(payload.ok_or_else(|| anyhow!("Missing payload"))?)?;
                     let targetlen = target.as_os_str().as_bytes().len();
-                    if targetlen > PATH_MAX as usize {
-                        anyhow::bail!("Target length too large {targetlen}");
+                    if targetlen > SYMLINK_MAX {
+                        anyhow::bail!(
+                            "Symlink target length {targetlen} exceeds limit {SYMLINK_MAX}"
+                        );
                     }
                     Item::Symlink { nlink, target }
                 }

crates/composefs/src/erofs/reader.rs

@@ -1350,6 +1350,14 @@ fn populate_directory<ObjectID: FsVerityHashValue>(
                 }
                 S_IFLNK => {
                     let target_data = child_inode.inline().unwrap_or(&[]);
+                    if target_data.len() > crate::SYMLINK_MAX {
+                        anyhow::bail!(
+                            "symlink target for {:?} is {} bytes (max {})",
+                            name,
+                            target_data.len(),
+                            crate::SYMLINK_MAX,
+                        );
+                    }
                     let target = OsStr::from_bytes(target_data);
                     tree::LeafContent::Symlink(Box::from(target))
                 }

crates/composefs/src/erofs/writer.rs

@@ -293,6 +293,12 @@ impl<ObjectID: FsVerityHashValue> Leaf<'_, ObjectID> {
                 (format::DataLayout::FlatPlain, 0, 0)
             }
             tree::LeafContent::Symlink(target) => {
+                assert!(
+                    target.len() <= crate::SYMLINK_MAX,
+                    "symlink target is {} bytes (max {})",
+                    target.len(),
+                    crate::SYMLINK_MAX,
+                );
                 (format::DataLayout::FlatInline, 0, target.len() as u64)
             }
         };

crates/composefs/src/lib.rs

@@ -45,6 +45,13 @@ pub const INLINE_CONTENT_MAX_V0: usize = 64;
 /// <https://github.com/composefs/composefs-rs/issues/107>).
 pub const MAX_INLINE_CONTENT: usize = 512;
 
+/// Maximum symlink target length in bytes.
+///
+/// XFS limits symlink targets to 1024 bytes (`XFS_SYMLINK_MAXLEN`). Since
+/// generic Linux containers are commonly backed by XFS, we enforce that
+/// limit rather than the Linux VFS `PATH_MAX` of 4096.
+pub const SYMLINK_MAX: usize = 1024;
+
 /// Internal constants shared across workspace crates.
 ///
 /// Not part of the public API — may change without notice.

crates/composefs/src/test.rs

@@ -131,8 +131,7 @@ pub(crate) mod proptest_strategies {
     /// EROFS limit (`EROFS_NAME_LEN`).
     const NAME_MAX: usize = 255;
 
-    /// Maximum symlink target length on Linux (`PATH_MAX`).
-    const PATH_MAX: usize = 4096;
+    use crate::SYMLINK_MAX;
 
     /// Strategy for valid filenames as OsString.
     ///
@@ -230,8 +229,7 @@ pub(crate) mod proptest_strategies {
     /// Strategy for symlink targets as OsString.
     ///
     /// Symlink targets on Linux are arbitrary bytes except `\0`, up to
-    /// [`PATH_MAX`] (4096) bytes.  We generate a mix of path-like ASCII
-    /// targets and binary targets, occasionally long.
+    /// [`SYMLINK_MAX`] (1024) bytes, matching the XFS limit.
     fn symlink_target() -> impl Strategy<Value = OsString> {
         prop_oneof![
             // Short path-like ASCII target (common case)
@@ -241,8 +239,8 @@ pub(crate) mod proptest_strategies {
             // Binary target with arbitrary bytes (no NUL)
             3 => prop::collection::vec(1..=0xFFu8, 1..=100)
                 .prop_map(OsString::from_vec),
-            // Long ASCII target (up to PATH_MAX)
-            1 => proptest::string::string_regex(&format!("[a-zA-Z0-9/._-]{{100,{PATH_MAX}}}"))
+            // Long ASCII target (up to SYMLINK_MAX)
+            1 => proptest::string::string_regex(&format!("[a-zA-Z0-9/._-]{{100,{SYMLINK_MAX}}}"))
                 .expect("valid regex")
                 .prop_map(OsString::from),
         ]