Skip to content

Conversation

@ksykulev
Copy link
Contributor

Related issue: Resolves fleetdm/fleet#34610

Fixing a bug that was discovered by upload carves >2gb.
It appears that the check for IsInt was not sufficient to check for larger integers. byte values of 2gb+ are greater than the max of int32. Switched to int64 to handle this properly.

@ksykulev ksykulev requested review from a team as code owners December 17, 2025 20:02
Copy link
Member

@zwass zwass left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some minore revisions requested, plus formatting.

ksykulev and others added 4 commits December 17, 2025 14:10
Co-authored-by: Zach Wasserman <zach@fleetdm.com>
Co-authored-by: Zach Wasserman <zach@fleetdm.com>
Co-authored-by: Zach Wasserman <zach@fleetdm.com>
@ksykulev ksykulev requested a review from zwass December 17, 2025 20:12
Copy link
Member

@zwass zwass left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome, thank you! Let's merge when CI passes.

@zwass zwass changed the title Changed carves.size to BIGINT Fix crash when querying carves table with carves larger than 2GB Dec 18, 2025
@zwass zwass merged commit 4729e76 into osquery:master Dec 18, 2025
21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Large file carves aren't working even after disabling the osquery watchdog

3 participants