🌴 Sync 2026-09-27 20:55:59

luci-app-fwlive/root/usr/libexec/rpcd/fwlive

@@ -66,6 +66,9 @@ slug_key() {
 # Cap rules JSON size so a huge ruleset cannot unbound an rpcd reply.
 RULES_MAP_MAX_KEYS=512
 RULES_MAP_MAX_BYTES=65536
+# First-wins dups never increment _map_keys, so they would otherwise walk
+# the whole dump. Bound map_prefix_with_label calls independently.
+RULES_MAP_MAX_LINES=512
 
 map_add() {
 	key="$1"
@@ -111,10 +114,12 @@ map_add() {
 uci_rule_names() {
 	# uci missing / empty firewall config is "no names", not fatal.
 	# pipefail + set -e cannot apply to this pipeline.
+	# One show dump; named-section names still use uci get.
+	_firewall_show=$(uci -q show firewall 2>/dev/null || true)
 	{
-		uci -q show firewall 2>/dev/null |
+		printf '%s\n' "$_firewall_show" |
 			sed -n "s/^firewall\.@rule\[[0-9]*\]\.name='\(.*\)'$/\1/p" || true
-		uci -q show firewall 2>/dev/null |
+		printf '%s\n' "$_firewall_show" |
 			sed -n 's/^firewall\.\([A-Za-z0-9_-]*\)=rule$/\1/p' |
 			while IFS= read -r section; do
 				uci -q get "firewall.${section}.name" 2>/dev/null || true
@@ -152,6 +157,11 @@ read_rpc_input() {
 map_prefix_with_label() {
 	prefix="$1"
 	label="$2"
+	if [ "${_map_lines:-0}" -ge "$RULES_MAP_MAX_LINES" ]; then
+		_map_overflow=1
+		return 0
+	fi
+	_map_lines=$(( ${_map_lines:-0} + 1 ))
 	prefix=$(normalize_log_prefix "$prefix")
 	[ -n "$prefix" ] || return 0
 	slug=$(slug_key "$prefix")
@@ -496,6 +506,7 @@ enrich_rules_dump() {
 build_rules_map() {
 	OUT=''
 	_map_keys=0
+	_map_lines=0
 	_map_overflow=''
 	_enrich_error=''
 	backend=unknown