{"record":{"id":"000745402f54d0cc","repo":"Pumpkin-MC/Pumpkin","slug":"duplicate-player-input-flag-flag","errorCode":null,"errorMessage":"duplicate player input flag {flag}","messagePattern":"duplicate player input flag (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/pumpkin-protocol/src/bedrock/server/player_auth_input.rs","lineNumber":64,"sourceCode":"        let mut input_data = Bitset::<66>::default();\n        if bool::read(reader)? {\n            let count = VarUInt::read(reader)?.0;\n            if count > 66 {\n                return Err(Error::new(\n                    ErrorKind::InvalidData,\n                    format!(\"too many player input flags: {count}\"),\n                ));\n            }\n            for _ in 0..count {\n                let flag = VarInt::read(reader)?.0;\n                if !(0..66).contains(&flag) {\n                    return Err(Error::new(\n                        ErrorKind::InvalidData,\n                        format!(\"invalid player input flag {flag}\"),\n                    ));\n                }\n                if input_data.get(flag as usize) {\n                    return Err(Error::new(\n                        ErrorKind::InvalidData,\n                        format!(\"duplicate player input flag {flag}\"),\n                    ));\n                }\n                input_data.set(flag as usize, true);\n            }\n        }\n        let input_mode = VarUInt::read(reader)?;\n        let play_mode = VarUInt::read(reader)?;\n        let interaction_model = VarInt::read(reader)?;\n        let interact_pitch = f32::read(reader)?;\n        let interact_yaw = f32::read(reader)?;\n        let tick = VarULong::read(reader)?;\n        let delta = Vector3::<f32>::read(reader)?;\n\n        // 1. Perform Item Interaction\n        let item_interaction = if bool::read(reader)? && bool::read(reader)? {\n            Some(PlayerInventoryAction::read(reader)?)","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/Pumpkin-MC/Pumpkin/blob/8d4639e25a57c15e47448ec327c780d41bbf2356/crates/pumpkin-protocol/src/bedrock/server/player_auth_input.rs#L46-L82","documentation":"This error is thrown while decoding the Bedrock PlayerAuthInput packet when the client's InputData bitfield repeats a PlayerInput flag that was already set in the same packet. The server rejects the packet as invalid data rather than tolerating redundant bits, because duplicated flags indicate a malformed or malicious packet.","triggerScenarios":"A client sends PlayerAuthInput whose InputData VarULong has a flag bit encoded more than once in the flag-listing sub-protocol (input_data.get(flag as usize) is already true when the flag is decoded).","commonSituations":"Bugged or modded Bedrock clients, custom/older protocol implementations, or crafted packets from untrusted clients probing the server.","solutions":["Update the client to a version matching the server's supported Bedrock protocol","Inspect the client's PlayerAuthInput serialization for duplicate flag emission","If you control middleware/proxies, re-encode InputData without duplicate flag bits","Kick the offending client; this is by-design rejection of malformed input"],"exampleFix":"// before (server-side strictness is correct; fix the sender)\ninput_data.set(flag as usize, true); // called twice for same flag\n// after (sender must emit each flag once)\nif !input_data.get(flag as usize) { input_data.set(flag as usize, true); }","handlingStrategy":"validation","validationCode":"// Cannot pre-validate raw wire input; on the server, ensure flags are set once:\nif input_data.get(flag as usize) { /* already set -> skip or reject */ }","typeGuard":null,"tryCatchPattern":"match decode_player_auth_input(buf) {\n    Err(e) if e.kind() == std::io::ErrorKind::InvalidData => { disconnect(client, e); }\n    Err(e) => propagate(e),\n    Ok(p) => handle(p),\n}","preventionTips":["Keep client and server Bedrock protocol versions in sync","Never hand-craft PlayerAuthInput packets; use the protocol crate's encoder","Log and drop invalid packets instead of panicking","Fuzz-test the decoder against malformed bitfields"],"tags":["bedrock","protocol","packet-decoding","input-validation"],"backgroundTag":"invalid-flag-value","analyzedSha":"8d4639e25a57c15e47448ec327c780d41bbf2356","analyzedAt":"2026-09-09T15:32:22.916Z","contentChangedAt":"2026-09-09T15:32:22.916Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}