{"record":{"id":"4e061bf36d64adf2","repo":"tokio-rs/tokio","slug":"filled-overflow","errorCode":null,"errorMessage":"filled overflow","messagePattern":"filled overflow","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"tokio/src/io/read_buf.rs","lineNumber":203,"sourceCode":"    /// Clears the buffer, resetting the filled region to empty.\n    ///\n    /// The number of initialized bytes is not changed, and the contents of the buffer are not modified.\n    #[inline]\n    pub fn clear(&mut self) {\n        self.filled = 0;\n    }\n\n    /// Advances the size of the filled region of the buffer.\n    ///\n    /// The number of initialized bytes is not changed.\n    ///\n    /// # Panics\n    ///\n    /// Panics if the filled region of the buffer would become larger than the initialized region.\n    #[inline]\n    #[track_caller]\n    pub fn advance(&mut self, n: usize) {\n        let new = self.filled.checked_add(n).expect(\"filled overflow\");\n        self.set_filled(new);\n    }\n\n    /// Sets the size of the filled region of the buffer.\n    ///\n    /// The number of initialized bytes is not changed.\n    ///\n    /// Note that this can be used to *shrink* the filled region of the buffer in addition to growing it (for\n    /// example, by a `AsyncRead` implementation that compresses data in-place).\n    ///\n    /// # Panics\n    ///\n    /// Panics if the filled region of the buffer would become larger than the initialized region.\n    #[inline]\n    #[track_caller]\n    pub fn set_filled(&mut self, n: usize) {\n        assert!(\n            n <= self.initialized,","sourceCodeStart":185,"sourceCodeEnd":221,"githubUrl":"https://github.com/tokio-rs/tokio/blob/625954f365727668cb02d04172b34f1149637728/tokio/src/io/read_buf.rs#L185-L221","documentation":"ReadBuf::advance computes self.filled.checked_add(n).expect('filled overflow'). It panics if advancing the filled region by n would overflow usize — almost always because n is huge (garbage) or the filled counter was already corrupted. set_filled(new) then enforces filled <= initialized.","triggerScenarios":"Calling read_buf.advance(n) with an absurd n (e.g. result of a buggy size computation, or passing bytes_read from a failed read); double-counting bytes already accounted for.","commonSituations":"AsyncRead impl that advances by the buffer length instead of the bytes actually read; passing buf.remaining() instead of n; integer underflow producing wraparound then overflow; off-by-one in a parser.","solutions":["Pass exactly the number of bytes newly written into the buffer (e.g. res from read).","Validate n <= buf.remaining() / initialized region before calling advance.","Use ReadBuf helpers (put_slice, put_u8, etc.) which manage filled correctly.","Add assertions/debug logging of n in your AsyncRead impl to catch corruption early."],"exampleFix":"// before\nlet n = read(&mut buf[written..])?;\nread_buf.advance(buf.len()); // wrong: full length, overflow risk\n// after\nlet n = read(&mut buf[written..])?;\nread_buf.advance(n); // only bytes actually read","handlingStrategy":"validation","validationCode":"// Validate n against the buffer's capacity before advancing:\nlet n = read(&mut buf[..])?;\nassert!(n <= read_buf.remaining(), \"advance too large\");\nread_buf.advance(n);","typeGuard":"fn safe_advance(buf: &mut tokio::io::ReadBuf<'_>, n: usize) -> Result<(), io::Error> {\n    if n > buf.remaining() {\n        return Err(io::Error::new(io::ErrorKind::InvalidInput, \"advance exceeds remaining\"));\n    }\n    buf.advance(n);\n    Ok(())\n}","tryCatchPattern":"// Use catch_unwind if you cannot trust the upstream AsyncRead:\nstd::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {\n    read_buf.advance(n);\n}))","preventionTips":["Pass only the bytes actually read (the return value of read).","Use ReadBuf put_* helpers which manage filled correctly.","Assert n <= buf.remaining() in your AsyncRead impl."],"tags":["io","read-buf","panic","arithmetic","async-read"],"backgroundTag":null,"analyzedSha":"625954f365727668cb02d04172b34f1149637728","analyzedAt":"2026-08-11T17:46:45.378Z","contentChangedAt":"2026-08-11T17:46:45.378Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}