Skip to content

bug: read_bitmap 8x allocation amplification and field_id as usize truncation #10

Description

@minagishl

Bug Description

Two related sub-issues:

  1. read_bitmap 8× allocation amplification (src/wire.rs): the decoder reads byte_count bytes (bounded by input) but allocates bit_count = byte_count * 8 booleans (one bool per bit). An input of 128 MiB requests a 1 GiB output. This amplifier is reachable from presence, TemplateBatch.changed_column_mask, TypedVector<Bool>, and Column.presence.
  2. field_id as usize truncation on 32-bit targets: field_id is decoded as u64 but is then cast to usize. On 32-bit targets (wasm32-unknown-unknown, i686-*), usize is u32, so values larger than u32::MAX silently truncate. This can cause the decoder to misindex schema field tables and read the wrong field.

Steps to Reproduce

For (1): construct a typed-vector with a large Bool bitmap declared length; decode and observe bit_count allocation.

For (2): build for wasm32. Send a message with field_id = 2^32 + 1. Decode. Observe the decoder treating it as field_id = 1.

Expected Behavior

(1) Either store bits packed (bitset) instead of Vec<bool>, or cap bit_count against the framed input size.

(2) Use field_id as u64 consistently and bounds-check before any usize cast (usize::try_from(field_id).ok().and_then(...)).

Actual Behavior

Direct allocation and truncating cast.

Environment

  • Crate: recurram
  • Reachable from: typed-vector decoder (1), schema/shape decoder (2)

Additional Context

Severity: Medium.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions