if filename.length is 65532 or larger, the value of packSHORT() will have wrapped. I don't think it's exploitable, as the decoder will just read less bytes than are present.