encoding

const (
	// MaxColumnValueBytes is the largest single value that can reach a chunk:
	// the WAL truncates every field to 1 MiB before it is sealed. (The larger
	// MaxValueBytes in strlen.go bounds the *framing*, not what the pipeline
	// actually admits.)
	MaxColumnValueBytes = 1 << 20
	// MaxVarintBytes is the widest encoding of one varint/zigzag-varint value.
	MaxVarintBytes = 10
	// MaxLenFramingBytes covers the length prefix stored alongside a
	// variable-length value.
	MaxLenFramingBytes = 8
)

Per-value ceilings used to derive a column's decoded-size bound.

const MaxBlockBytes = 2 << 30 // 2 GiB

MaxBlockBytes is the largest uncompressed block the codec supports. It is the absolute decoder ceiling *and* the encoder's contract: anything larger than this seals fine but can never be read back, so Compress reports a violation loudly instead of producing a write-only block. A chunk holds up to 50k rows, so this leaves ~40KB per row for the biggest single-block column (message).

It is deliberately *not* the ceiling any single column decode runs under — see DecodeCeiling. Bounding only the compressed bytes against the file size let a corrupt or crafted 2 MB column expand toward 2 GiB inside a search goroutine; every column decode now runs under a ceiling derived from its own value count.

const MaxDictEntries = 65535

MaxDictEntries is the largest dictionary DictMarshal can represent: the serialized entry count is a uint16, so 65535 entries (indices 0..65534) is the ceiling. Beyond it the count would wrap and the whole column would decode to garbage, so DictEncode stops growing the dictionary instead.

const (

	// MaxValueBytes bounds a single length-prefixed value. It exists so a corrupt
	// length can never be used for an unbounded allocation; decoders additionally
	// check the length against the bytes actually available.
	MaxValueBytes = 1 << 30 // 1 GiB
)