Pumpkin-MC/Pumpkin · warning

Vector length exceeds limit of 65536

Error message

Vector length {len} exceeds limit of 65536

What it means

Thrown by the `PacketRead for Vec<T>` impl when the length prefix read as VarUInt exceeds 65536 elements. The cap prevents malicious packets from triggering enormous allocations. Note capacity is only preallocated for min(len,1024), so oversized lengths are rejected before any growth.

Solutions

1. Verify protocol version alignment between client and server
2. Check for desync: confirm preceding fields parsed correctly
3. Reject/drop the packet and optionally ban the offending peer
4. If the data is legitimately large, raise the 65536 limit consciously in a fork

Example fix

// before
let items: Vec<ItemStack> = reader.read()?;
// after
match Vec::<ItemStack>::read(&mut reader) {
    Ok(items) => items,
    Err(e) => { log::warn!("oversized vec in packet: {e}"); drop_connection(); }
}

let (count, _) = VarUInt::peek(reader)?;
if count > 65536 { return Err(PacketError::OversizedVector(count)); }

fn is_valid_vec_len(len: usize) -> bool { len <= 65536 }

match Vec::<T>::read(&mut reader) {
    Ok(v) => v,
    Err(e) => { log::warn!("vec limit exceeded: {e}"); drop_connection(); }
}

When it happens

Trigger: Deserializing a Vec<T> field whose VarUInt length prefix is > 65536; corrupted or malicious packet data; stream desync misreading bytes as a length.

Common situations: Malicious client sending huge array counts; desynced byte stream where a random int is parsed as the vector length; protocol version mismatch.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• block_actions count exceeds limit
• durability correction must fit in an i16
• expected bool byte
• expected i16
• expected i32

AI-assisted analysis of Pumpkin-MC/Pumpkin@8d4639e25a (2026-09-09). Data as JSON: /api/errors/7988f9b9e56582b9. Report an issue: GitHub.

Appendix: source

Thrown at crates/pumpkin-protocol/src/serial/deserializer.rs:177

            return Err(Error::new(
                ErrorKind::InvalidData,
                format!("String length {len} exceeds maximum of {MAX_STRING_LENGTH}"),
            ));
        }

        let mut buf = vec![0u8; len];
        reader.read_exact(&mut buf)?;

        Self::from_utf8(buf)
            .map_err(|_| Error::new(ErrorKind::InvalidData, "Invalid UTF-8 sequence"))
    }
}

impl<T: PacketRead> PacketRead for Vec<T> {
    fn read<R: Read>(reader: &mut R) -> Result<Self, Error> {
        let len = VarUInt::read(reader)?.0 as usize;
        if len > 65536 {
            return Err(Error::new(
                ErrorKind::InvalidData,
                format!("Vector length {len} exceeds limit of 65536"),
            ));
        }
        let mut buf = Self::with_capacity(len.min(1024));
        for _ in 0..len {
            buf.push(T::read(reader)?);
        }
        Ok(buf)
    }
}

impl<T: PacketRead> PacketRead for Vector3<T> {
    fn read<R: Read>(reader: &mut R) -> Result<Self, Error> {
        Ok(Self {
            x: T::read(reader)?,
            y: T::read(reader)?,
            z: T::read(reader)?,

View on GitHub (pinned to 8d4639e25a)