I really think we can ignore the server-reported file_length altogether; it is untrusted input anyway. @vladdd , what do you think?