fix(io): pace sendfile with --bwlimit, retry poll EINTR, clamp SSL_read

src/shared/file_send.c

@@ -166,6 +166,8 @@ bool file_send_sendfile_with_skip(File* file, int file_descriptor, bool use_meta
     }
     struct pollfd pfd = {.fd = file_descriptor, .events = POLLOUT};
     int polled = poll(&pfd, 1, timeout);
+    if (polled < 0 && errno == EINTR)
+      continue;
     if (polled <= 0 || (pfd.revents & (POLLERR | POLLHUP | POLLNVAL))) {
       close(fd);
       return false;
@@ -183,6 +185,7 @@ bool file_send_sendfile_with_skip(File* file, int file_descriptor, bool use_meta
       return false;
     }
     protocol_note_bytes_written((unsigned long long)sent);
+    protocol_throttle_bytes((size_t)sent);
   }
 
   close(fd);

src/shared/protocol.c

@@ -301,6 +301,14 @@ static ProtocolSession* legacy_session(int read_fd, int write_fd) {
   return &legacy_io_session;
 }
 
+/* Pace an out-of-band write that bypassed protocol_send_n_data (the plaintext
+ * sendfile fast path).  The bound/legacy session is resolved exactly as
+ * send_n_data resolves it, so the same token-bucket state is throttled and the
+ * TLS and plaintext transports share identical --bwlimit semantics. */
+void protocol_throttle_bytes(size_t bytes) {
+  bw_throttle_session(legacy_session(-1, -1), bytes);
+}
+
 bool send_n_data(int file_descriptor, const void* data, size_t data_size) {
   return protocol_send_n_data(legacy_session(-1, file_descriptor), data, data_size);
 }
@@ -439,12 +447,18 @@ static bool protocol_receive_n_data_until(ProtocolSession* session, void* data,
     }
 
     ssize_t bytes_received;
-    if (session->ssl)
-      bytes_received = SSL_read(session->ssl, (char*)data + total_bytes_received,
-                                data_size - total_bytes_received);
-    else
+    if (session->ssl) {
+      /* SSL_read takes an int length; clamp a >INT_MAX request into chunks
+       * (mirrors the send path) so the size_t downcast can never truncate into
+       * a negative/partial read. */
+      size_t ssl_chunk = data_size - total_bytes_received > (size_t)INT_MAX
+                             ? (size_t)INT_MAX
+                             : data_size - total_bytes_received;
+      bytes_received = SSL_read(session->ssl, (char*)data + total_bytes_received, (int)ssl_chunk);
+    } else {
       bytes_received =
           read(fd, (char*)data + total_bytes_received, data_size - total_bytes_received);
+    }
     if (bytes_received <= 0) {
       if (session->ssl) {
         int ssl_err = SSL_get_error(session->ssl, (int)bytes_received);

src/shared/protocol.h

@@ -220,6 +220,12 @@ SSL* io_get_ssl(void);
 unsigned long long protocol_bytes_written(void);
 unsigned long long protocol_bytes_read(void);
 void protocol_note_bytes_written(unsigned long long bytes);
+/* Apply --bwlimit pacing to bytes written outside protocol_send_n_data (the
+ * plaintext zero-copy sendfile fast path).  Resolves the bound/legacy session
+ * exactly as send_n_data does and runs the same token-bucket throttle, so the
+ * sendfile transport is paced identically to the buffered/TLS paths.  A no-op
+ * when the effective session has no bandwidth limit. */
+void protocol_throttle_bytes(size_t bytes);
 
 void protocol_session_init(ProtocolSession* session, int read_fd, int write_fd);
 /* Transitional bridge for helpers whose signatures still carry only an fd. */