309 lines
8.4 KiB
Rust
309 lines
8.4 KiB
Rust
|
#![forbid(unsafe_code)]
|
||
|
|
//! Bounded little-endian binary cursor and checked layout helpers.
|
||
|
|
|
||
|
|
use std::fmt;
|
||
|
|
|
||
|
|
/// Parser limits shared by binary formats.
|
||
|
|
#[derive(Clone, Copy, Debug)]
|
||
|
|
pub struct Limits {
|
||
|
|
/// Maximum file bytes.
|
||
|
|
pub max_file_bytes: u64,
|
||
|
|
/// Maximum entries.
|
||
|
|
pub max_entries: u32,
|
||
|
|
/// Maximum string bytes.
|
||
|
|
pub max_string_bytes: u32,
|
||
|
|
/// Maximum array items.
|
||
|
|
pub max_array_items: u32,
|
||
|
|
/// Maximum recursion depth.
|
||
|
|
pub max_recursion_depth: u16,
|
||
|
|
/// Maximum decoded bytes.
|
||
|
|
pub max_decoded_bytes: u64,
|
||
|
|
}
|
||
|
|
|
||
|
|
impl Default for Limits {
|
||
|
|
fn default() -> Self {
|
||
|
|
Self {
|
||
|
|
max_file_bytes: 256 * 1024 * 1024,
|
||
|
|
max_entries: 1_000_000,
|
||
|
|
max_string_bytes: 64 * 1024,
|
||
|
|
max_array_items: 1_000_000,
|
||
|
|
max_recursion_depth: 64,
|
||
|
|
max_decoded_bytes: 512 * 1024 * 1024,
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/// Decode error.
|
||
|
|
#[derive(Clone, Debug, Eq, PartialEq)]
|
||
|
|
pub enum DecodeError {
|
||
|
|
/// Input ended before requested bytes.
|
||
|
|
UnexpectedEof {
|
||
|
|
/// Offset where read was attempted.
|
||
|
|
offset: u64,
|
||
|
|
/// Required byte count.
|
||
|
|
needed: u64,
|
||
|
|
/// Remaining byte count.
|
||
|
|
remaining: u64,
|
||
|
|
},
|
||
|
|
/// Arithmetic overflow.
|
||
|
|
IntegerOverflow,
|
||
|
|
/// Count exceeds limit.
|
||
|
|
LimitExceeded {
|
||
|
|
/// Declared count.
|
||
|
|
count: u64,
|
||
|
|
/// Configured limit.
|
||
|
|
limit: u64,
|
||
|
|
},
|
||
|
|
/// Cursor did not end at EOF.
|
||
|
|
TrailingBytes {
|
||
|
|
/// Offset where EOF was expected.
|
||
|
|
offset: u64,
|
||
|
|
/// Remaining byte count.
|
||
|
|
remaining: u64,
|
||
|
|
},
|
||
|
|
/// Invalid data.
|
||
|
|
Invalid(&'static str),
|
||
|
|
}
|
||
|
|
|
||
|
|
impl fmt::Display for DecodeError {
|
||
|
|
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
|
||
|
|
match self {
|
||
|
|
Self::UnexpectedEof {
|
||
|
|
offset,
|
||
|
|
needed,
|
||
|
|
remaining,
|
||
|
|
} => write!(
|
||
|
|
f,
|
||
|
|
"unexpected EOF at {offset}: need {needed}, have {remaining}"
|
||
|
|
),
|
||
|
|
Self::IntegerOverflow => write!(f, "integer overflow"),
|
||
|
|
Self::LimitExceeded { count, limit } => {
|
||
|
|
write!(f, "count {count} exceeds limit {limit}")
|
||
|
|
}
|
||
|
|
Self::TrailingBytes { offset, remaining } => {
|
||
|
|
write!(f, "trailing bytes at {offset}: {remaining}")
|
||
|
|
}
|
||
|
|
Self::Invalid(reason) => write!(f, "invalid data: {reason}"),
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
impl std::error::Error for DecodeError {}
|
||
|
|
|
||
|
|
/// Cursor checkpoint.
|
||
|
|
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
|
||
|
|
pub struct Checkpoint(pub u64);
|
||
|
|
|
||
|
|
/// Bounded cursor.
|
||
|
|
#[derive(Clone, Debug)]
|
||
|
|
pub struct Cursor<'a> {
|
||
|
|
bytes: &'a [u8],
|
||
|
|
offset: usize,
|
||
|
|
}
|
||
|
|
|
||
|
|
impl<'a> Cursor<'a> {
|
||
|
|
/// Creates a cursor.
|
||
|
|
#[must_use]
|
||
|
|
pub fn new(bytes: &'a [u8]) -> Self {
|
||
|
|
Self { bytes, offset: 0 }
|
||
|
|
}
|
||
|
|
|
||
|
|
/// Current offset.
|
||
|
|
#[must_use]
|
||
|
|
pub fn offset(&self) -> u64 {
|
||
|
|
self.offset as u64
|
||
|
|
}
|
||
|
|
|
||
|
|
/// Remaining bytes.
|
||
|
|
#[must_use]
|
||
|
|
pub fn remaining(&self) -> usize {
|
||
|
|
self.bytes.len().saturating_sub(self.offset)
|
||
|
|
}
|
||
|
|
|
||
|
|
/// Creates a checkpoint.
|
||
|
|
#[must_use]
|
||
|
|
pub fn checkpoint(&self) -> Checkpoint {
|
||
|
|
Checkpoint(self.offset())
|
||
|
|
}
|
||
|
|
|
||
|
|
/// Reads exact bytes.
|
||
|
|
///
|
||
|
|
/// # Errors
|
||
|
|
///
|
||
|
|
/// Returns [`DecodeError::IntegerOverflow`] if the requested end offset
|
||
|
|
/// overflows, or [`DecodeError::UnexpectedEof`] if there are not enough
|
||
|
|
/// bytes remaining.
|
||
|
|
pub fn read_exact(&mut self, len: usize) -> Result<&'a [u8], DecodeError> {
|
||
|
|
let end = self
|
||
|
|
.offset
|
||
|
|
.checked_add(len)
|
||
|
|
.ok_or(DecodeError::IntegerOverflow)?;
|
||
|
|
if end > self.bytes.len() {
|
||
|
|
return Err(DecodeError::UnexpectedEof {
|
||
|
|
offset: self.offset(),
|
||
|
|
needed: len as u64,
|
||
|
|
remaining: self.remaining() as u64,
|
||
|
|
});
|
||
|
|
}
|
||
|
|
let out = &self.bytes[self.offset..end];
|
||
|
|
self.offset = end;
|
||
|
|
Ok(out)
|
||
|
|
}
|
||
|
|
|
||
|
|
/// Reads a little-endian u16.
|
||
|
|
///
|
||
|
|
/// # Errors
|
||
|
|
///
|
||
|
|
/// Returns [`DecodeError`] if two bytes cannot be read.
|
||
|
|
pub fn read_u16_le(&mut self) -> Result<u16, DecodeError> {
|
||
|
|
let b = self.read_exact(2)?;
|
||
|
|
Ok(u16::from_le_bytes([b[0], b[1]]))
|
||
|
|
}
|
||
|
|
|
||
|
|
/// Reads a little-endian u32.
|
||
|
|
///
|
||
|
|
/// # Errors
|
||
|
|
///
|
||
|
|
/// Returns [`DecodeError`] if four bytes cannot be read.
|
||
|
|
pub fn read_u32_le(&mut self) -> Result<u32, DecodeError> {
|
||
|
|
let b = self.read_exact(4)?;
|
||
|
|
Ok(u32::from_le_bytes([b[0], b[1], b[2], b[3]]))
|
||
|
|
}
|
||
|
|
|
||
|
|
/// Reads a little-endian i32.
|
||
|
|
///
|
||
|
|
/// # Errors
|
||
|
|
///
|
||
|
|
/// Returns [`DecodeError`] if four bytes cannot be read.
|
||
|
|
pub fn read_i32_le(&mut self) -> Result<i32, DecodeError> {
|
||
|
|
let b = self.read_exact(4)?;
|
||
|
|
Ok(i32::from_le_bytes([b[0], b[1], b[2], b[3]]))
|
||
|
|
}
|
||
|
|
|
||
|
|
/// Reads a little-endian f32.
|
||
|
|
///
|
||
|
|
/// # Errors
|
||
|
|
///
|
||
|
|
/// Returns [`DecodeError`] if four bytes cannot be read.
|
||
|
|
pub fn read_f32_le(&mut self) -> Result<f32, DecodeError> {
|
||
|
|
Ok(f32::from_bits(self.read_u32_le()?))
|
||
|
|
}
|
||
|
|
|
||
|
|
/// Requires exact EOF.
|
||
|
|
///
|
||
|
|
/// # Errors
|
||
|
|
///
|
||
|
|
/// Returns [`DecodeError::TrailingBytes`] when unread bytes remain.
|
||
|
|
pub fn require_eof(&self) -> Result<(), DecodeError> {
|
||
|
|
if self.remaining() == 0 {
|
||
|
|
Ok(())
|
||
|
|
} else {
|
||
|
|
Err(DecodeError::TrailingBytes {
|
||
|
|
offset: self.offset(),
|
||
|
|
remaining: self.remaining() as u64,
|
||
|
|
})
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
/// Validates `count * stride <= remaining` and returns bytes as usize.
|
||
|
|
///
|
||
|
|
/// # Errors
|
||
|
|
///
|
||
|
|
/// Returns [`DecodeError::IntegerOverflow`] on arithmetic or conversion
|
||
|
|
/// overflow, or [`DecodeError::UnexpectedEof`] when the declared byte count is
|
||
|
|
/// larger than the remaining bounded input.
|
||
|
|
pub fn checked_count_bytes(count: u64, stride: u64, remaining: u64) -> Result<usize, DecodeError> {
|
||
|
|
let bytes = count
|
||
|
|
.checked_mul(stride)
|
||
|
|
.ok_or(DecodeError::IntegerOverflow)?;
|
||
|
|
if bytes > remaining {
|
||
|
|
return Err(DecodeError::UnexpectedEof {
|
||
|
|
offset: 0,
|
||
|
|
needed: bytes,
|
||
|
|
remaining,
|
||
|
|
});
|
||
|
|
}
|
||
|
|
usize::try_from(bytes).map_err(|_| DecodeError::IntegerOverflow)
|
||
|
|
}
|
||
|
|
|
||
|
|
/// Validates a declared allocation size before constructing the allocation.
|
||
|
|
///
|
||
|
|
/// # Errors
|
||
|
|
///
|
||
|
|
/// Returns [`DecodeError::LimitExceeded`] when `declared` is larger than
|
||
|
|
/// `limit`, or [`DecodeError::IntegerOverflow`] when the accepted size cannot
|
||
|
|
/// be represented by the host `usize`.
|
||
|
|
pub fn checked_allocation_len(declared: u64, limit: u64) -> Result<usize, DecodeError> {
|
||
|
|
if declared > limit {
|
||
|
|
return Err(DecodeError::LimitExceeded {
|
||
|
|
count: declared,
|
||
|
|
limit,
|
||
|
|
});
|
||
|
|
}
|
||
|
|
usize::try_from(declared).map_err(|_| DecodeError::IntegerOverflow)
|
||
|
|
}
|
||
|
|
|
||
|
|
/// Reads length-prefixed bytes.
|
||
|
|
///
|
||
|
|
/// # Errors
|
||
|
|
///
|
||
|
|
/// Returns [`DecodeError`] if the length cannot be read, exceeds `max`, or the
|
||
|
|
/// declared payload is truncated.
|
||
|
|
pub fn read_lp_bytes(cursor: &mut Cursor<'_>, max: u32) -> Result<Vec<u8>, DecodeError> {
|
||
|
|
let len = cursor.read_u32_le()?;
|
||
|
|
if len > max {
|
||
|
|
return Err(DecodeError::LimitExceeded {
|
||
|
|
count: u64::from(len),
|
||
|
|
limit: u64::from(max),
|
||
|
|
});
|
||
|
|
}
|
||
|
|
let len = checked_allocation_len(u64::from(len), u64::from(max))?;
|
||
|
|
Ok(cursor.read_exact(len)?.to_vec())
|
||
|
|
}
|
||
|
|
|
||
|
|
#[cfg(test)]
|
||
|
|
mod tests {
|
||
|
|
use super::*;
|
||
|
|
|
||
|
|
#[test]
|
||
|
|
fn rejects_count_stride_overflow() {
|
||
|
|
assert_eq!(
|
||
|
|
checked_count_bytes(u64::MAX, 2, u64::MAX),
|
||
|
|
Err(DecodeError::IntegerOverflow)
|
||
|
|
);
|
||
|
|
}
|
||
|
|
|
||
|
|
#[test]
|
||
|
|
fn exact_eof_reports_trailing() {
|
||
|
|
let mut cursor = Cursor::new(&[1, 2]);
|
||
|
|
assert_eq!(cursor.read_exact(1).expect("byte"), &[1]);
|
||
|
|
assert!(matches!(
|
||
|
|
cursor.require_eof(),
|
||
|
|
Err(DecodeError::TrailingBytes { .. })
|
||
|
|
));
|
||
|
|
}
|
||
|
|
|
||
|
|
#[test]
|
||
|
|
fn rejects_oversized_declared_allocation_before_read() {
|
||
|
|
assert_eq!(
|
||
|
|
checked_allocation_len(1025, 1024),
|
||
|
|
Err(DecodeError::LimitExceeded {
|
||
|
|
count: 1025,
|
||
|
|
limit: 1024
|
||
|
|
})
|
||
|
|
);
|
||
|
|
|
||
|
|
let bytes = 2048u32.to_le_bytes();
|
||
|
|
let mut cursor = Cursor::new(&bytes);
|
||
|
|
assert_eq!(
|
||
|
|
read_lp_bytes(&mut cursor, 1024),
|
||
|
|
Err(DecodeError::LimitExceeded {
|
||
|
|
count: 2048,
|
||
|
|
limit: 1024
|
||
|
|
})
|
||
|
|
);
|
||
|
|
assert_eq!(cursor.offset(), 4);
|
||
|
|
}
|
||
|
|
}
|