Pumpkin-MC/Pumpkin · error

extra_data_len exceeds 1MB limit

Error message

extra_data_len exceeds 1MB limit

What it means

Raised when reading an item's extra data block: the VarUInt length prefix exceeds 1,048,576 bytes (1MB). Like the user_data guard, this prevents unbounded allocation from corrupt or malicious input and fails with ErrorKind::InvalidData before the vec! allocation.

Solutions

1. Audit preceding field reads for desync — a misread varint is the usual cause.
2. Verify protocol versions align between reader and writer.
3. Reject the packet (drop or disconnect) instead of retrying the same bytes.
4. Writers must clamp extra data to <=1MB before serialization.

Example fix

// before
let extra = vec![0u8; extra_data_len];
buf.read_exact(&mut extra)?;
// after
if extra_data_len > 1_048_576 {
    return Err(Error::new(ErrorKind::InvalidData, "extra_data_len exceeds 1MB limit"));
}

// caller-side pre-check when parsing manually
if extra_data_len > 1_048_576 { return Err(malformed_packet()); }

match read_item_with_extra_data(buf) {
    Ok(v) => v,
    Err(e) if e.kind() == std::io::ErrorKind::InvalidData => {
        disconnect_peer("oversized extra data");
    }
    Err(e) => return Err(e),
}

When it happens

Trigger: Deserializing a network item (network_item.rs:302 read path) where extra_data_len > 1MB — stream desync, corrupted buffer, or crafted packet.

Common situations: Malicious client inflating the length field; parser reading the wrong field as the length after a version mismatch; truncated/mixed-up packet stream.

Understand the failure class

Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.

Related errors

• user_data_len exceeds 1MB limit
• Invalid ContainerName ID
• item string array length out of bounds
• String::from_utf8 error
• Nbt read error

AI-assisted analysis of Pumpkin-MC/Pumpkin@8d4639e25a (2026-09-09). Data as JSON: /api/errors/5173f9231563b22d. Report an issue: GitHub.

Appendix: source

Thrown at crates/pumpkin-protocol/src/bedrock/network_item.rs:302

    fn read<R: Read>(buf: &mut R) -> Result<Self, Error> {
        let id = i16::read(buf)?;

        let stack_size = u16::read(buf)?;
        let aux_value = VarUInt::read(buf)?;

        let has_net_id = bool::read(buf)?;
        let net_id = if has_net_id {
            let stack_id = VarInt::read(buf)?;
            NonZero::new(stack_id.0)
        } else {
            None
        };

        let block_runtime_id = VarUInt::read(buf)?;

        let extra_data_len = VarUInt::read(buf)?.0 as usize;
        if extra_data_len > 1_048_576 {
            return Err(Error::new(
                ErrorKind::InvalidData,
                "extra_data_len exceeds 1MB limit",
            ));
        }
        let mut extra_data = vec![0u8; extra_data_len];
        buf.read_exact(&mut extra_data)?;

        Ok(Self {
            id,
            stack_size,
            aux_value,
            block_runtime_id,
            extra_data,
            net_id,
        })
    }
}

View on GitHub (pinned to 8d4639e25a)