Pumpkin-MC/Pumpkin · error

block_actions count exceeds limit

Error message

block_actions count exceeds limit

What it means

Thrown when decoding the BlockActions section of a Bedrock PlayerAuthInput packet whose declared action count exceeds the hard limit of 1024. This prevents a client from making the server allocate/parse an unbounded number of block actions in a single packet.

Solutions

1. Ensure the client uses the correct Bedrock protocol version matching the server
2. Check for packet corruption or desync earlier in the stream
3. If a legit client needs more than 1024 actions per packet, raise the limit in player_auth_input.rs with care
4. Reject/ban clients that repeatedly send oversized counts

let count = VarUInt::read(reader)?.0 as usize;
if count > 1024 { return Err(...); } // caller-side: reject before iterating

match read_packet(&mut stream) {
    Err(e) if e.kind() == std::io::ErrorKind::InvalidData => warn!("oversized block_actions, dropping packet"),
    other => other,
}

When it happens

Trigger: PlayerAuthInput packet where both leading bools are true and the following VarUInt count is > 1024.

Common situations: Malicious or buggy clients sending inflated block-action counts to stress the server (DoS vector), or a protocol mismatch causing garbage to be read as the count.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• actions_len exceeds limit
• duplicate player input flag
• hit_count exceeds limit
• Invalid ability value type
• invalid Bedrock respawn state

AI-assisted analysis of Pumpkin-MC/Pumpkin@8d4639e25a (2026-09-09). Data as JSON: /api/errors/34189d2773a00868. Report an issue: GitHub.

Appendix: source

Thrown at crates/pumpkin-protocol/src/bedrock/server/player_auth_input.rs:98

        // 1. Perform Item Interaction
        let item_interaction = if bool::read(reader)? && bool::read(reader)? {
            Some(PlayerInventoryAction::read(reader)?)
        } else {
            None
        };

        // 2. Item Stack Request
        let item_stack_request = if bool::read(reader)? && bool::read(reader)? {
            Some(crate::bedrock::server::item_stack_request::ItemStackRequest::read(reader)?)
        } else {
            None
        };

        // 3. Block Actions
        let block_actions = if bool::read(reader)? && bool::read(reader)? {
            let count = VarUInt::read(reader)?.0 as usize;
            if count > 1024 {
                return Err(Error::new(
                    ErrorKind::InvalidData,
                    "block_actions count exceeds limit",
                ));
            }
            let mut actions = Vec::with_capacity(count.min(64));
            for _ in 0..count {
                actions.push(PlayerBlockAction::read(reader)?);
            }
            Some(actions)
        } else {
            None
        };

        // 4. Vehicle Info (Matches Go logic)
        let vehicle_rotation = (bool::read(reader)? && bool::read(reader)?)
            .then(|| Vector2::<f32>::read(reader))
            .transpose()?;
        let vehicle_unique_id = (bool::read(reader)? && bool::read(reader)?)

View on GitHub (pinned to 8d4639e25a)