[deadp]

EWF2 chunk indexes are capped by the declared image size, and oversized registry log hive sizes or page offsets are refused.
AFF4 chunk and member inflation is capped with decompressobj, and PDF #HH name escapes are decoded before matching and neutralising.
One new test per part (new tests/test_pdfdoc.py); full pytest suite passes.

Queued from the dashboard (item 309). The request:

Goal (audit 21-10-2026, hostile evidence files): cap three unbounded allocations and fix PDF name matching. (a) engine/ewf2.py takes first_chunk from the file then loops range(last + 1): cap last against the image's sector count (or keep chunks in a dict) so a crafted EWF2 cannot exhaust memory. (b) engine/reglog.py (~line 205) extends the hive by hbins_size read from the log with no bound: reject sizes above a sane limit tied to the hive/log size. (c) engine/aff4.py (lines ~435 and ~519) calls zlib.decompress unbounded: use zlib.decompressobj with max_length set to the expected chunk size and fail on overflow. (d) engine/pdfdoc.py matches active-content names on raw bytes and never decodes #HH escapes, so /Java#53cript slips through: decode #HH in names before matching. One test per part with a small crafted input. This fix will also be offered upstream to switch-nz/strata as its own PR, so keep it small and focused: only the files the fix needs, upstream's code style, a test, no fork-only files or docs.

Opened by the queue runner on LXC 113. The runner squash-merges this once CI checks pass.

🤖 Generated with Claude Code