Repository navigation
Conversation
A corrupt map length can make alloc-backed visitors reserve megabytes before reading any key. Match the existing sequence guard in postcard and postcard2: omit the hint when known remaining payload bytes are fewer than the claimed entries. This does not reject zero-byte unit entries or change unknown-length reader hints. Public allocator probes and regressions cover the malformed-input case and valid unit maps. Addresses the map gap in jamesmunns#307.
✅ Deploy Preview for cute-starship-2d9c9b canceled.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses the
MapAccessportion of #307 in bothpostcardandpostcard2.Both map deserializers currently return the claimed entry count directly as their size hint. With the three-byte input
[0xc0, 0x84, 0x3d], deserializing aHashMap<u8, u8>requests a 3,145,736-byte allocation before returning the expected input error. Apply the same conservative remaining-payload check already used bySeqAccess: omit an impossible hint without rejecting the map itself.The regressions cover the malformed input and valid maps with zero-byte unit entries. A standalone public-API consumer with a recording system allocator confirms that the large reservation becomes zero in both versions; Vec and BTreeMap controls remain unchanged. Both new regressions fail on the base commit and pass here.
Validation: the complete
ci.shpassed locally (195 tests; workspace checks and strict Clippy; both thumb configurations and the RISC-V no-atomics configuration; formatting; nightly documentation with warnings denied). The exact final commit also received independent agent source review and a separate run of both focused regressions.This deliberately leaves the unknown-length reader-flavor part of #307 unchanged and does not claim to prevent every allocation from malformed input. Codex assisted with implementation and validation; the independent review described above is agent review, not maintainer or human approval.