Skip to content

fix(mem_forest): return writer errors from serialize instead of panicking - #160

Open
USCMig wants to merge 1 commit into
mit-dci:mainfrom
USCMig:fix-memforest-deserialize-untrusted
Open

USCMig wants to merge 1 commit into
mit-dci:mainfrom
USCMig:fix-memforest-deserialize-untrusted

Conversation

@USCMig

@USCMig USCMig commented Sep 14, 2026 •

Copy link
Copy Markdown

MemForest::serialize panics on a failing writer

Rebased onto main. The deserialize fixes this PR originally carried landed
independently in 69484de ("apply fixes for bugs found while fuzzing"), so that
commit is dropped. What remains is the one fix main doesn't have yet.

serialize returns io::Result<()> and ?s its two length prefixes, but then
unwrap()s the result of writing each root:

root.write_one(&mut writer).unwrap();

A writer that fails partway (a full disk, a closed pipe, a socket that went
away) panics instead of returning the Err the signature promises. The fix is
?.

Testing

test_serialize_reports_writer_errors serializes a forest into a writer with
room for the two length prefixes but not for the roots. It expects
ErrorKind::WriteZero, then checks that the same forest still serializes into
an unbounded writer.

Reverting the fix makes exactly this test fail, and it panics at
src/mem_forest/mod.rs:271.

cargo test --all-features passes (105 tests). cargo clippy --all-targets --all-features is clean, and so is cargo +nightly fmt --check. There is no
public API change, and no behaviour change for any writer that succeeds.

A note on 69484de, not a request

main bounds _read_one at depth > MAX_FOREST_ROWS + 1. A root has at most
MAX_FOREST_ROWS rows, so its leaves are at most that many levels down, and
> MAX_FOREST_ROWS is the tight bound. The + 1 is harmless, since the
recursion is bounded either way. I'm mentioning it only because the tighter
form was in this PR before the rebase.

@Davidson-Souza

Copy link
Copy Markdown
Collaborator

Needs rebase.

@USCMig USCMig changed the title fix(mem_forest): make deserialize total on untrusted input fix(mem_forest): return writer errors from serialize instead of panicking Sep 24, 2026
@USCMig
USCMig force-pushed the fix-memforest-deserialize-untrusted branch from 3e55267 to 04c45d0 Compare September 24, 2026 03:36
@USCMig

USCMig commented Sep 24, 2026

Copy link
Copy Markdown
Author

new commit to cleanly merge

@Davidson-Souza

Copy link
Copy Markdown
Collaborator

CI is red.

…king

`serialize` returns `io::Result<()>` and uses `?` for the two length
prefixes, but then `unwrap()`ed the result of writing each root. A
writer that fails partway -- a full disk, a closed pipe, a socket that
went away -- panics rather than returning the `Err` the signature
promises.

Separate from the deserialize fixes in the previous commit and safe to
take on its own: this one is about a failing writer, not untrusted
input.
@USCMig
USCMig force-pushed the fix-memforest-deserialize-untrusted branch from 04c45d0 to 940ce48 Compare October 4, 2026 04:08
@USCMig

USCMig commented Oct 4, 2026

Copy link
Copy Markdown
Author

Fixed CI issue and it green, ready to merge. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants