{"record":{"id":"0f3239e9f55970b2","repo":"Pumpkin-MC/Pumpkin","slug":"too-many-player-input-flags-count","errorCode":null,"errorMessage":"too many player input flags: {count}","messagePattern":"too many player input flags: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/pumpkin-protocol/src/bedrock/server/player_auth_input.rs","lineNumber":50,"sourceCode":"    pub vehicle_rotation: Option<Vector2<f32>>,\n    pub vehicle_unique_id: Option<VarLong>,\n    pub analog_move: Vector2<f32>,\n    pub camera_orientation: Vector3<f32>,\n    pub raw_move: Vector2<f32>,\n}\n\nimpl PacketRead for SPlayerAuthInput {\n    fn read<R: Read>(reader: &mut R) -> Result<Self, Error> {\n        let pitch = f32::read(reader)?;\n        let yaw = f32::read(reader)?;\n        let position = Vector3::<f32>::read(reader)?;\n        let move_vec = Vector2::<f32>::read(reader)?;\n        let head_yaw = f32::read(reader)?;\n        let mut input_data = Bitset::<66>::default();\n        if bool::read(reader)? {\n            let count = VarUInt::read(reader)?.0;\n            if count > 66 {\n                return Err(Error::new(\n                    ErrorKind::InvalidData,\n                    format!(\"too many player input flags: {count}\"),\n                ));\n            }\n            for _ in 0..count {\n                let flag = VarInt::read(reader)?.0;\n                if !(0..66).contains(&flag) {\n                    return Err(Error::new(\n                        ErrorKind::InvalidData,\n                        format!(\"invalid player input flag {flag}\"),\n                    ));\n                }\n                if input_data.get(flag as usize) {\n                    return Err(Error::new(\n                        ErrorKind::InvalidData,\n                        format!(\"duplicate player input flag {flag}\"),\n                    ));\n                }","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/Pumpkin-MC/Pumpkin/blob/8d4639e25a57c15e47448ec327c780d41bbf2356/crates/pumpkin-protocol/src/bedrock/server/player_auth_input.rs#L32-L68","documentation":"Thrown while decoding PlayerAuthInput when the optional input-flags count VarUInt exceeds 66, the exact capacity of the Bitset<66> used to store player input flags. Any larger count cannot be represented, so the decoder rejects the packet with an InvalidData error instead of overflowing the bitset.","triggerScenarios":"A client sends a PlayerAuthInput packet whose input-flags count field is > 66; seen with crafted/fuzzed packets or protocol drift that misaligns the stream before the count field.","commonSituations":"Modified clients, DoS probes on the player-input path, or server/client version mismatch after a Bedrock update.","solutions":["Verify client and server Bedrock protocol versions match","Dump the raw packet to confirm the declared flag count","If a newer protocol adds input flags beyond 66, widen the Bitset and the 66 bound together","Reject or kick clients that repeatedly send malformed input packets"],"exampleFix":"// before (crafting a PlayerAuthInput)\nlet flag_count: VarUInt = VarUInt(100);\n// after\nlet flag_count: VarUInt = VarUInt(12); // must be <= 66","handlingStrategy":"validation","validationCode":"fn input_flag_count_ok(count: u32) -> bool { count <= 66 }","typeGuard":"fn to_flag_count(c: u32) -> Option<u32> { (c <= 66).then_some(c) }","tryCatchPattern":"match PlayerAuthInput::read(reader) {\n    Err(e) if e.to_string().contains(\"too many player input flags\") => { mark_suspect(peer); Ok(()) }\n    Err(e) => Err(e),\n    Ok(input) => apply_input(input),\n}","preventionTips":["Keep the Bitset capacity and the count bound in one constant to avoid drift","Update both when a protocol release extends the input-flag set","Flag peers that send out-of-bounds counts repeatedly"],"tags":["protocol","bedrock","deserialization","bitset","size-limit"],"backgroundTag":"value-out-of-range","analyzedSha":"8d4639e25a57c15e47448ec327c780d41bbf2356","analyzedAt":"2026-09-09T15:32:22.916Z","contentChangedAt":"2026-09-09T15:32:22.916Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}