{"record":{"id":"85194a5650b41e23","repo":"ruvnet/ruflo","slug":"section-id-exceeds-buffer-bounds","errorCode":null,"errorMessage":"Section \"${id}\" exceeds buffer bounds","messagePattern":"Section \"(.+?)\" exceeds buffer bounds","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/cli/src/appliance/rvfa-format.ts","lineNumber":416,"sourceCode":"  /** List all sections declared in the header. */\n  getSections(): RvfaSection[] {\n    return this.header.sections;\n  }\n\n  /**\n   * Extract and decompress a section by its id.\n   *\n   * @param id  The section identifier (e.g. 'kernel', 'runtime').\n   * @returns   The decompressed section payload.\n   */\n  extractSection(id: string): Buffer {\n    const sec = this.header.sections.find((s) => s.id === id);\n    if (!sec) {\n      throw new Error(`Section \"${id}\" not found`);\n    }\n\n    if (sec.offset + sec.size > this.buf.length - SHA256_SIZE) {\n      throw new Error(`Section \"${id}\" exceeds buffer bounds`);\n    }\n\n    const raw = this.buf.subarray(sec.offset, sec.offset + sec.size);\n\n    if (sec.compression === 'gzip') {\n      return gunzipSync(raw);\n    }\n    if (sec.compression === 'zstd') {\n      // zstd not natively supported — attempt gzip fallback (mirrors writer)\n      try {\n        return gunzipSync(raw);\n      } catch {\n        throw new Error(\n          'zstd decompression is not supported in this environment',\n        );\n      }\n    }\n","sourceCodeStart":398,"sourceCodeEnd":434,"githubUrl":"https://github.com/ruvnet/ruflo/blob/6b01dc5a687b26b3e218f796de45ec51f8fa9e8c/v3/@claude-flow/cli/src/appliance/rvfa-format.ts#L398-L434","documentation":"Thrown when a section's declared offset+size would read past the end of the buffer minus the trailing SHA256 footer. The header's geometry disagrees with the actual bytes, indicating a corrupt, truncated, or tampered image.","triggerScenarios":"Extracting a section from an RVFA whose header declares offset/size beyond the buffer: interrupted download, partial write, a hand-edited header, or a writer/reader version skew producing inconsistent offsets.","commonSituations":"Download cut short; file truncated by a size-limited channel; mismatched writer and reader versions; bit-flip in offset/size fields.","solutions":["Re-acquire the RVFA file (re-download or rebuild) and retry.","Run the reader's integrity/verify routine before extracting sections.","Confirm writer and reader are the same RVFA format version."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const SHA256_SIZE = 32;\nfunction sectionFits(buf: Buffer, sec: { offset: number; size: number }): boolean {\n  return sec.offset + sec.size <= buf.length - SHA256_SIZE;\n}\nconst sec = reader.getSections().find(s => s.id === id);\nif (sec && !sectionFits(buf, sec)) {\n  throw new Error('RVFA file appears truncated; re-acquire it');\n}","typeGuard":null,"tryCatchPattern":"try {\n  return reader.extractSection(id);\n} catch (e) {\n  if (e instanceof Error && /exceeds buffer bounds/.test(e.message)) {\n    // re-download / rebuild the image, then retry once with fresh bytes\n  }\n  throw e;\n}","preventionTips":["Verify the RVFA integrity (SHA256 footer) before extracting sections.","Treat truncation as unrecoverable for those bytes; do not retry in place.","Cross-check file size against the producer's recorded size."],"tags":["rvfa","buffer-bounds","data-corruption","integrity"],"backgroundTag":null,"analyzedSha":"6b01dc5a687b26b3e218f796de45ec51f8fa9e8c","analyzedAt":"2026-08-12T13:20:50.148Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}