wasm: sizes a server or a dataset names are errors, not aborts

A read longer than isize::MAX (2 GiB on wasm32) aborted the module in
LazyStorage::assemble (capacity_overflow), taking every open file on the
page with it, and a hostile server only had to claim a large length and
serve a heap collection of 2 GiB + 4 KiB to get there (after fetching
2 GiB). Reading a large u8 dataset whole aborted the same way when its
values were widened to 64 bits.

- LazyConfig::max_fetch (openUrl option maxFetch, default 512 MiB, at
  most 1 GiB): a read longer than it fails at once, before anything is
  fetched, and an operation whose passes would fetch more than it fails
  before fetching (Operation::charge). assemble reserves fallibly.
- Reader::read refuses a read that would use more than 1 GiB while
  decoding (core::MAX_READ_BYTES: stored bytes + 64-bit values + result)
  with an error naming readHyperslab, before reading.
- openUrl refuses a file of 4 GiB or more at open on wasm32: the format
  code turns offsets into usize, so nothing past 4 GiB can be read there
  (shown by a new test: data at 3 GiB reads, a 4 GiB file is refused).
  maxDownload is bounded to 1 GiB.

Tests: make_fixture.py writes limits.h5 (a sparse 2^28 + 1024 byte u8
dataset), hostile_vl.h5 (the reviewer's collection) and far.h5 (data at
3 GiB); test.mjs (wasm32) and tests/lazy.rs (native) check each is an
error or reads, and that the module survives. Before: RuntimeError:
unreachable in Node; the native test read the huge dataset and fetched
2 GiB.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

examples/wasm-viewer/test/test.mjs

@@ -321,6 +321,8 @@ async function remoteTests() {
     await f.read("/grid");
   }, /unusable Content-Range/, "unusable Content-Range");
 
+  await limitTests();
+
   // Corpus files: what the viewer can show of each is the same read by
   // ranges as in memory (an error wherever it gives one).
   const corpus = process.env.CLAWHDF5_WASM_CORPUS;
@@ -328,6 +330,87 @@ async function remoteTests() {
   console.log(`openUrl: ${checks - before} checks passed`);
 }
 
+// A fetch that serves `buf` as a file of `total` bytes (zeros past the end
+// of `buf`, and `extra` = [[offset, bytes], ...] laid over them), counting
+// its calls. `hide` leaves out Content-Range and the validators, as a
+// cross-origin server that exposes neither does; HEAD then gives the length.
+function mockFetch(buf, { total = buf.length, extra = [], hide = false } = {}) {
+  const f = async (url, init) => {
+    f.calls++;
+    if (init.method === "HEAD") {
+      return new Response(null, { status: 200, headers: { "Content-Length": String(total) } });
+    }
+    const m = /^bytes=(\d+)-(\d+)$/.exec(new Headers(init.headers).get("Range"));
+    const a = Number(m[1]);
+    const b = Math.min(Number(m[2]) + 1, total);
+    const out = new Uint8Array(b - a);
+    for (const [at, bytes] of [[0, buf], ...extra]) {
+      const from = Math.max(a, at);
+      const to = Math.min(b, at + bytes.length);
+      if (from < to) out.set(bytes.subarray(from - at, to - at), from - a);
+    }
+    const headers = { "Content-Length": String(b - a) };
+    if (!hide) headers["Content-Range"] = `bytes ${a}-${b - 1}/${total}`;
+    return new Response(out, { status: 206, headers });
+  };
+  f.calls = 0;
+  return f;
+}
+
+// Sizes a hostile server or a large dataset can name are errors, never an
+// allocation that aborts the module (which would take every open file on
+// the page with it); see write_limits in make_fixture.py.
+async function limitTests() {
+  // Read whole, /huge_u8 (2^28 + 1024 bytes) would take over 2 GiB while
+  // decoding: refused before its chunks are fetched; a window reads.
+  const n = 2 ** 28 + 1024;
+  const limits = readFileSync(join(fixDir, "limits.h5"));
+  const local = pkg.open(new Uint8Array(limits));
+  await fails(() => local.read("/huge_u8"), /readHyperslab/, "huge read, in memory");
+  const remote = await pkg.openUrl(`${base}/fix/limits.h5`);
+  const before = remote.stats().requests;
+  await fails(() => remote.read("/huge_u8"), /readHyperslab/, "huge read, openUrl");
+  eq(remote.stats().requests, before, "huge read fetched nothing");
+  eq(Array.from((await remote.readHyperslab("/huge_u8", [n - 4], [4])).data), [0, 0, 0, 7], "huge window");
+  eq(Array.from(local.readHyperslab("/huge_u8", [n - 4], [4]).data), [0, 0, 0, 7], "huge window, in memory");
+  local.free();
+
+  // A server claiming 3 GiB, a heap collection claiming 2 GiB + 4 KiB: an
+  // error after a few requests (it used to fetch 2 GiB, then abort).
+  const hostile = mockFetch(new Uint8Array(readFileSync(join(fixDir, "hostile_vl.h5"))), { total: 3 * 2 ** 30 });
+  const h = await pkg.openUrl("http://hostile.invalid/h.h5", { fetch: hostile });
+  await fails(() => h.read("/a"), /maxFetch/, "hostile collection size");
+  assert.ok(hostile.calls <= 4, `hostile: ${hostile.calls} requests`);
+  // The module survived: files open and read.
+  eq((await (await pkg.openUrl(`${base}/fix/fixture.h5`)).read("/sensors/temp")).data[0], 21.5, "alive after hostile");
+
+  // A call that would fetch more than maxFetch fails before fetching it.
+  await fails(async () => {
+    const f = await pkg.openUrl(`${base}/fix/fixture.h5`, { blockSize: 512, maxFetch: 1024 });
+    await f.read("/grid");
+  }, /maxFetch/, "maxFetch");
+  await fails(() => pkg.openUrl(`${base}/fix/fixture.h5`, { maxFetch: 2 ** 31 }), /maxFetch/, "maxFetch range");
+  await fails(() => pkg.openUrl(`${base}/fix/fixture.h5`, { maxDownload: 2 ** 31 }), /maxDownload/, "maxDownload range");
+
+  // Offsets past 2 GiB work on wasm32: far.h5's data sits at 3 GiB.
+  const far = JSON.parse(readFileSync(join(fixDir, "far.json"), "utf8"));
+  const farBytes = new Uint8Array(readFileSync(join(fixDir, "far.h5")));
+  const farData = farBytes.subarray(far.data_at, far.data_at + far.nbytes);
+  const ff = await pkg.openUrl("http://far.invalid/far.h5", {
+    fetch: mockFetch(farBytes, { total: far.length, extra: [[far.far_at, farData]] }),
+  });
+  eq(Array.from((await ff.read("/x")).data), far.values, "data past 2 GiB");
+  eq(ff.stats().size, far.length, "size past 2 GiB");
+
+  // wasm32's reader holds file offsets in 32 bits: a file of 4 GiB or more
+  // is refused at open, with the limit in the message (past 2^53 - 1 bytes
+  // a JavaScript number is not even exact).
+  for (const total of [2 ** 32, 2 ** 40, 2 ** 53 + 2]) {
+    await fails(() => pkg.openUrl("http://huge.invalid/x.h5", { fetch: mockFetch(farBytes, { total }) }),
+      total > 2 ** 53 ? /2\^53 - 1/ : /4 GiB/, `length ${total}`);
+  }
+}
+
 function hdf5Files(dir, out) {
   for (const e of readdirSync(dir, { withFileTypes: true })) {
     const p = join(dir, e.name);