Put a max object size check at the start of this method, before we update objectDigest, using the sz parameter. This will allow you to catch any object that is in the pack file in "whole" representation before we commit to allocating the buffer for it, or even computing its SHA-1.

The downside is you cannot tell the user what the SHA-1 is of the huge object. I would argue we shouldn't try, its expensive to inflate and compute the SHA-1 of something that is really big and will be rejected by the server. But if you still really want to do that, you should instead do it with the type == BLOB case below.