From fa9486650e8de2be117757b1891fa0aacc4c47cd Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Wed, 4 Nov 2026 01:30:24 +0100
Subject: downloads: cap yt-dlp media size

---
 src/voice/mod.rs | 12 ++++++++++++
 1 file changed, 12 insertions(+)

(limited to 'src/voice/mod.rs')

diff --git a/src/voice/mod.rs b/src/voice/mod.rs
index 5043508..d8308eb 100644
--- a/src/voice/mod.rs
+++ b/src/voice/mod.rs
@@ -26,6 +26,10 @@ use crate::recording::{Recorder, RecorderEventHandler};
 /// and the ffmpeg `s16le` encode. Must match the `DecodeConfig` set in `main.rs`.
 const RECORDING_SAMPLE_RATE: u32 = 48000;
 
+/// Upper bound for yt-dlp media buffered in memory. Audio is decoded to f32
+/// PCM afterwards (another 4x), so a multi-hundred-MB download would OOM.
+const MAX_MEDIA_BYTES: usize = 128 * 1024 * 1024;
+
 #[derive(Clone)]
 pub struct VoiceManager {
     pub songbird: Arc<Songbird>,
@@ -247,6 +251,8 @@ pub async fn ytdlp_download(url: &str) -> Result<Vec<u8>> {
                 "-o",
                 "-",
                 "--no-playlist",
+                "--max-filesize",
+                "128M",
                 "--",
                 url,
             ])
@@ -269,6 +275,12 @@ pub async fn ytdlp_download(url: &str) -> Result<Vec<u8>> {
         );
         return Err(Error::Custom(lang::fmt_ytdlp_stderr(&stderr)));
     }
+    if output.stdout.len() > MAX_MEDIA_BYTES {
+        return Err(Error::Custom(format!(
+            "media is too large (limit {} MiB)",
+            MAX_MEDIA_BYTES / (1024 * 1024)
+        )));
+    }
 
     Ok(output.stdout)
 }
-- 
cgit v1.2.3