Return an error if a decoded slice length doesn't fit into usize #491
Conversation
Bincode encodes a slice length, which is an usize, as an u64. When such an encoded slice length needs to be decoded it again uses an u64 but critically it truncates it into an usize. An usize is architecture dependent, it is the size how many bytes it takes to reference any location in memory. The most common sizes for an usize are 64, 32, and 16 bit. This might lead to silent data loss if the architecture that encoded the slice differs from the architecture that decoded the slice, i.e. if we go from a 64 bit architecture to a 32 or 16 bit one. Since bincode aims to be suitable for storage, aiming to support the exchange of data between different architectures silently truncating such slice lenghts should be avoided. This patch changes the behaviour to error out if we try to decode an slice lenght that can't fit into the current usize type.
poljar
force-pushed
the
poljar/check-if-len-fits-in-usize
branch
from
12195db to
a4c92d5
Compare
Codecov Report
@@ Coverage Diff @@
## trunk #491 +/- ##
==========================================
+ Coverage 69.26% 69.32% +0.05%
==========================================
Files 39 39
Lines 2925 2927 +2
==========================================
+ Hits 2026 2029 +3
+ Misses 899 898 -1
Continue to review full report at Codecov.
|
|
Quick scan through the source code to see if we have some more cases where we cast to usize, found some:
Can you add this check to the 2 places above? |
Did so, I also renamed the error variant since it isn't length specific anymore. |
|
Thanks! |
Bincode encodes a slice length, which is an usize, as an u64. When such an encoded slice length needs to be decoded it again uses an u64 but critically it truncates it into an usize.
An usize is architecture dependent, it is the size how many bytes it takes to reference any location in memory. The most common sizes for an usize are 64, 32, and 16 bit.
This might lead to silent data loss if the architecture that encoded the slice differs from the architecture that decoded the slice, i.e. if we go from a 64 bit architecture to a 32 or 16 bit one.
Since bincode aims to be suitable for storage, aiming to support the exchange of data between different architectures silently truncating such slice lenghts should be avoided.
This patch changes the behaviour to error out if we try to decode an slice lenght that can't fit into the current usize type.