Pumpkin-MC/Pumpkin · error

too many player input flags

Error message

too many player input flags: {count}

What it means

Thrown while decoding PlayerAuthInput when the optional input-flags count VarUInt exceeds 66, the exact capacity of the Bitset<66> used to store player input flags. Any larger count cannot be represented, so the decoder rejects the packet with an InvalidData error instead of overflowing the bitset.

Solutions

1. Verify client and server Bedrock protocol versions match
2. Dump the raw packet to confirm the declared flag count
3. If a newer protocol adds input flags beyond 66, widen the Bitset and the 66 bound together
4. Reject or kick clients that repeatedly send malformed input packets

Example fix

// before (crafting a PlayerAuthInput)
let flag_count: VarUInt = VarUInt(100);
// after
let flag_count: VarUInt = VarUInt(12); // must be <= 66

fn input_flag_count_ok(count: u32) -> bool { count <= 66 }

fn to_flag_count(c: u32) -> Option<u32> { (c <= 66).then_some(c) }

match PlayerAuthInput::read(reader) {
    Err(e) if e.to_string().contains("too many player input flags") => { mark_suspect(peer); Ok(()) }
    Err(e) => Err(e),
    Ok(input) => apply_input(input),
}

When it happens

Trigger: A client sends a PlayerAuthInput packet whose input-flags count field is > 66; seen with crafted/fuzzed packets or protocol drift that misaligns the stream before the count field.

Common situations: Modified clients, DoS probes on the player-input path, or server/client version mismatch after a Bedrock update.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• extra_data length exceeds limit
• Bitset too large
• Connection request length
• extra_data_len exceeds 1MB limit
• Invalid ContainerName ID

AI-assisted analysis of Pumpkin-MC/Pumpkin@8d4639e25a (2026-09-09). Data as JSON: /api/errors/0f3239e9f55970b2. Report an issue: GitHub.

Appendix: source

Thrown at crates/pumpkin-protocol/src/bedrock/server/player_auth_input.rs:50

    pub vehicle_rotation: Option<Vector2<f32>>,
    pub vehicle_unique_id: Option<VarLong>,
    pub analog_move: Vector2<f32>,
    pub camera_orientation: Vector3<f32>,
    pub raw_move: Vector2<f32>,
}

impl PacketRead for SPlayerAuthInput {
    fn read<R: Read>(reader: &mut R) -> Result<Self, Error> {
        let pitch = f32::read(reader)?;
        let yaw = f32::read(reader)?;
        let position = Vector3::<f32>::read(reader)?;
        let move_vec = Vector2::<f32>::read(reader)?;
        let head_yaw = f32::read(reader)?;
        let mut input_data = Bitset::<66>::default();
        if bool::read(reader)? {
            let count = VarUInt::read(reader)?.0;
            if count > 66 {
                return Err(Error::new(
                    ErrorKind::InvalidData,
                    format!("too many player input flags: {count}"),
                ));
            }
            for _ in 0..count {
                let flag = VarInt::read(reader)?.0;
                if !(0..66).contains(&flag) {
                    return Err(Error::new(
                        ErrorKind::InvalidData,
                        format!("invalid player input flag {flag}"),
                    ));
                }
                if input_data.get(flag as usize) {
                    return Err(Error::new(
                        ErrorKind::InvalidData,
                        format!("duplicate player input flag {flag}"),
                    ));
                }

View on GitHub (pinned to 8d4639e25a)