Skip to content

fix(ipc): reject buffer alignments no reader can accept - #9880

Closed
jackylee-ch wants to merge 1 commit into
vortex-data:developfrom
jackylee-ch:fix/ipc-encoder-alignment-bound
Closed

jackylee-ch wants to merge 1 commit into
vortex-data:developfrom
jackylee-ch:fix/ipc-encoder-alignment-bound

Conversation

@jackylee-ch

Copy link
Copy Markdown
Contributor

MessageDecoder reads the buffer alignment back through
Alignment::try_from_untrusted_exponent (messages/decoder.rs:144), which bails above
Alignment::MAX_UNTRUSTED — 64 KiB, per alignment.rs:23. The encoder wrote whatever exponent
the buffer carried (messages/encoder.rs:93), so a buffer aligned beyond that wrote successfully
and then failed on every read, with the error surfacing on the reader's side.

encode already returns VortexResult, so the check costs nothing structurally.

This is the write-side half of #9155, which added the read-side ceiling; it does not overlap
#9186, which bounds the allocations the decoder asks for.

Tests

cargo test --release -p vortex-ipc: 8 passed, 6 before. The accepting case covers 1 B through
64 KiB, the rejecting case 128 KiB and 1 MiB. Disabling the new guard fails the rejecting test and
leaves the accepting one green.

AI assistance

Written with agentic AI assistance; I read the decoder's call to
try_from_untrusted_exponent and the MAX_UNTRUSTED definition before adding the bound.

`MessageDecoder` reads the buffer alignment back through
`Alignment::try_from_untrusted_exponent`, which refuses anything above
`Alignment::MAX_UNTRUSTED` (64 KiB). The encoder wrote whatever exponent the
buffer carried, so a larger alignment produced a stream that written
successfully and then failed on every read.

Bail at the write site instead, where the caller still has the buffer.

Signed-off-by: jackylee-ch <qcsd2011@gmail.com>
@github-actions

Copy link
Copy Markdown
Contributor

This PR has been marked as stale because it has been open for 14 days with no activity. Please comment or remove the stale label if you wish to keep it active, otherwise it will be closed in 7 days

@github-actions github-actions Bot added the stale This PR is stale and will be auto-closed soon label Sep 30, 2026
@jackylee-ch

Copy link
Copy Markdown
Contributor Author

Closing this. The Buffer arm it guards has no callers in the workspace, while the paths that are used have the same gap: the Array arm records each buffer's alignment exponent through serialize, and the file writer records the first buffer's alignment in its segment specs, and both are read back through try_from_untrusted_exponent. That wants one check where exponents are written rather than a guard on this arm.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

stale This PR is stale and will be auto-closed soon

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant