Bug Description
Two related sub-issues:
read_bitmap 8× allocation amplification (src/wire.rs): the decoder reads byte_count bytes (bounded by input) but allocates bit_count = byte_count * 8 booleans (one bool per bit). An input of 128 MiB requests a 1 GiB output. This amplifier is reachable from presence, TemplateBatch.changed_column_mask, TypedVector<Bool>, and Column.presence.
field_id as usize truncation on 32-bit targets: field_id is decoded as u64 but is then cast to usize. On 32-bit targets (wasm32-unknown-unknown, i686-*), usize is u32, so values larger than u32::MAX silently truncate. This can cause the decoder to misindex schema field tables and read the wrong field.
Steps to Reproduce
For (1): construct a typed-vector with a large Bool bitmap declared length; decode and observe bit_count allocation.
For (2): build for wasm32. Send a message with field_id = 2^32 + 1. Decode. Observe the decoder treating it as field_id = 1.
Expected Behavior
(1) Either store bits packed (bitset) instead of Vec<bool>, or cap bit_count against the framed input size.
(2) Use field_id as u64 consistently and bounds-check before any usize cast (usize::try_from(field_id).ok().and_then(...)).
Actual Behavior
Direct allocation and truncating cast.
Environment
- Crate:
recurram
- Reachable from: typed-vector decoder (1), schema/shape decoder (2)
Additional Context
Severity: Medium.
Bug Description
Two related sub-issues:
read_bitmap8× allocation amplification (src/wire.rs): the decoder readsbyte_countbytes (bounded by input) but allocatesbit_count = byte_count * 8booleans (oneboolper bit). An input of 128 MiB requests a 1 GiB output. This amplifier is reachable frompresence,TemplateBatch.changed_column_mask,TypedVector<Bool>, andColumn.presence.field_id as usizetruncation on 32-bit targets:field_idis decoded asu64but is then cast tousize. On 32-bit targets (wasm32-unknown-unknown,i686-*),usizeisu32, so values larger thanu32::MAXsilently truncate. This can cause the decoder to misindex schema field tables and read the wrong field.Steps to Reproduce
For (1): construct a typed-vector with a large
Boolbitmap declared length; decode and observebit_countallocation.For (2): build for
wasm32. Send a message withfield_id = 2^32 + 1. Decode. Observe the decoder treating it asfield_id = 1.Expected Behavior
(1) Either store bits packed (bitset) instead of
Vec<bool>, or capbit_countagainst the framed input size.(2) Use
field_id as u64consistently and bounds-check before anyusizecast (usize::try_from(field_id).ok().and_then(...)).Actual Behavior
Direct allocation and truncating cast.
Environment
recurramAdditional Context
Severity: Medium.