{"record":{"id":"30afefacd3d4678a","repo":"atuinsh/atuin","slug":"exceeded-maximum-length","errorCode":null,"errorMessage":"exceeded maximum length","messagePattern":"exceeded maximum length","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"crates/atuin-nucleo/src/boxcar.rs","lineNumber":613,"sourceCode":"\n#[derive(Debug)]\nstruct Location {\n    // the index of the bucket\n    bucket: u32,\n    // the length of `bucket`\n    bucket_len: u32,\n    // the index of the entry in `bucket`\n    entry: u32,\n}\n\n// skip the shorter buckets to avoid unnecessary allocations.\n// this also reduces the maximum capacity of a vector.\nconst SKIP: u32 = 32;\nconst SKIP_BUCKET: u32 = (u32::BITS - SKIP.leading_zeros()) - 1;\n\nimpl Location {\n    fn of(index: u32) -> Location {\n        let skipped = index.checked_add(SKIP).expect(\"exceeded maximum length\");\n        let bucket = u32::BITS - skipped.leading_zeros();\n        let bucket = bucket - (SKIP_BUCKET + 1);\n        let bucket_len = Location::bucket_len(bucket);\n        let entry = skipped ^ bucket_len;\n\n        Location {\n            bucket,\n            bucket_len,\n            entry,\n        }\n    }\n\n    fn bucket_len(bucket: u32) -> u32 {\n        1 << (bucket + SKIP_BUCKET)\n    }\n\n    /// The entry index at which the next bucket should be pre-allocated.\n    fn alloc_next_bucket_entry(&self) -> u32 {","sourceCodeStart":595,"sourceCodeEnd":631,"githubUrl":"https://github.com/atuinsh/atuin/blob/15fe1318f1df51de604262eb50734c9883d48e7b/crates/atuin-nucleo/src/boxcar.rs#L595-L631","documentation":"`Location::of` maps a flat u32 index to bucket/entry coordinates, first doing `index.checked_add(SKIP).expect(\"exceeded maximum length\")` with SKIP=32. The top 32 index values (index > 4,294,967,263) have no representable location, so the panic marks the last few slots of the index space as reserved - effectively the same 2^32 capacity ceiling enforced by the push/extend guards.","triggerScenarios":"Reserving the final indices after ~4.29 billion pushes (the counter guards in push/extend usually fire first); calling boxcar internals directly with a near-u32::MAX index.","commonSituations":"Not reachable via atuin/nucleo public APIs under realistic data sizes; only fuzzing or synthetic multi-billion-row workloads.","solutions":["Enforce the same bound the public paths need: total items <= 4,294,967,263 (u32::MAX minus SKIP)","Shard datasets rather than filling one vector to its ceiling","Treat a hit through a public API as an upstream capacity bug and report it"],"exampleFix":"// before\nvec.push(value, fill); // may reach the reserved tail indices\n\n// after\nconst MAX_INDEX: u64 = u32::MAX as u64 - 32;\nif inflight_count < MAX_INDEX {\n    vec.push(value, fill);\n    inflight_count += 1;\n} else {\n    return Err(CapacityError);\n}","handlingStrategy":"validation","validationCode":"// Enforce the reserved top-of-index-space margin (SKIP = 32)\nconst MAX_ITEMS: u64 = u64::from(u32::MAX - 32);\nif inflight_count >= MAX_ITEMS {\n    return Err(CapacityError);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Apply the same u32::MAX-minus-32 bound your pushes already need","Do not call boxcar's Location/index internals directly with unvalidated indices","Shard rather than fill one vector to its ceiling"],"tags":["rust","panic","integer-overflow","capacity","nucleo","lock-free"],"backgroundTag":"integer-overflow","analyzedSha":"15fe1318f1df51de604262eb50734c9883d48e7b","analyzedAt":"2026-08-19T08:56:57.719Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}