Repository navigation
fix(rvf-wire): reject malformed decoder input without panicking - #1236
Conversation
…f-wire-fallible-decoders-20261020
Apply the remaining HOT_SEG allocation bound from Martin Vladimirov's prepared RVF repair (local commit 61b74c2). VEC_SEG and INDEX_SEG validation remains unchanged. Observe allocation requests with a bounded count of 4096: empty and 12-byte payloads previously reserved 229376 bytes. Add aligned round-trip, truncation and zero-count controls. Suggested-by: Martin Vladimirov
|
Completed the comparison with Martin's prepared RVF fix (local 61b74c2). Existing VEC_SEG/INDEX_SEG protections cover his cases; our tenth-byte varint validation remains. The remaining HOT_SEG allocation bound is incorporated in 261a693, attributed to Martin. Bounded regression evidence (count 4096): before the fix, empty/12-byte payloads reserved 229376 bytes and two tests failed; afterward, all 77 RVF wire tests, five release-mode controls and strict all-target Clippy pass. Valid aligned round trips and truncation behavior are retained. Independent source/test review found no blocker. Martin confirmed the ownership handoff. Source comparison is complete; dependency-stack reconciliation and refreshed head-specific CI follow. Posted by Codex for Dragan; host=ruos-dev; session=ruvector-final-review-20261021. |
Malformed RVF vector/adjacency blocks can panic despite Result-returning APIs. Validate count/size relationships before allocating, propagate truncated/overflowing ID errors, reject directory/ID mismatches and unknown encodings, and reject overflowing u64 varints. Valid raw and delta/restart representations are preserved.
Martin’s supplied local RVF patch (61b74c2) has now been compared: VEC/INDEX repairs were already covered. Incorporate his additional HOT_SEG reservation bound, limiting capacity by payload size before decoding. Martin confirmed handoff; no parallel implementation remains pending.
Validation: full RVF suite 77 passed; five new bounded-allocation tests passed in release; strict all-target Clippy passed. The allocation observer reproduced the old excessive reservation with small controlled data and now passes. Independent review found no blocker, including 32-bit arithmetic and valid alignment. Earlier decoder tests and golden vectors passed debug/release. CRC policy and unknown dtype fallback remain outside scope.
Stack: #1230 → #1242 → #1245, then this feature. The shared graph repair retains rUv’s source from #1180. ZIP advisories are repaired without an exception; Rust 1.88 was explicitly accepted. Supply-chain PR triggers now cover stacked branches.
Combined qualification is running on exact commit
335102e9cd97a4ec7fc081d26b17733b2e7d9692: workspace, strict Clippy, Python wheels, portfolio, supply chain, GNN, benchmark smoke. Pending results are not represented as passes. CI workflow changes are separately reviewed in #1248.Prepared by Codex acting for Dragan. Review requested; no main merge, release, tag or registry publication is authorized.