{"record":{"id":"a40b39418110fd20","repo":"Pumpkin-MC/Pumpkin","slug":"too-large-0","errorCode":null,"errorMessage":"too large: {0}","messagePattern":"too large: (.+?)","errorType":"exception","errorClass":"ReadingError","httpStatus":null,"severity":"warning","filePath":"crates/pumpkin-protocol/src/ser/mod.rs","lineNumber":25,"sourceCode":"    codec::{\n        bit_set::BitSet, var_int::VarInt, var_long::VarLong, var_uint::VarUInt, var_ulong::VarULong,\n    },\n};\n\nuse pumpkin_nbt::{\n    compound::NbtCompound, deserializer::NbtReadHelper, serializer::NbtWriteHelperJava, tag::NbtTag,\n};\nuse pumpkin_util::math::position::BlockPos;\nuse pumpkin_util::{text::TextComponent, version::JavaMinecraftVersion};\nuse thiserror::Error;\n\n#[derive(Debug, Error)]\npub enum ReadingError {\n    #[error(\"EOF, Tried to read {0} but No bytes left to consume\")]\n    CleanEOF(String),\n    #[error(\"incomplete: {0}\")]\n    Incomplete(String),\n    #[error(\"too large: {0}\")]\n    TooLarge(String),\n    #[error(\"{0}\")]\n    Message(String),\n}\n\nimpl serde::de::Error for ReadingError {\n    fn custom<T: std::fmt::Display>(msg: T) -> Self {\n        Self::Message(msg.to_string())\n    }\n}\n\n#[derive(Debug, Error)]\npub enum WritingError {\n    #[error(\"IO error: {0}\")]\n    IoError(#[from] std::io::Error),\n    #[error(\"Serde failure: {0}\")]\n    Serde(String),\n    #[error(\"Packet is not supported in Minecraft version {0:?}\")]","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/Pumpkin-MC/Pumpkin/blob/8d4639e25a57c15e47448ec327c780d41bbf2356/crates/pumpkin-protocol/src/ser/mod.rs#L7-L43","documentation":"ReadingError::TooLarge is raised when a decoded size exceeds a configured limit — typically a length prefix (string length, array length, or packet length) that would require reading more data than allowed. It protects the server from malicious or corrupt length fields that would cause huge allocations or memory-exhaustion DoS.","triggerScenarios":"Deserializing a packet whose VarInt or fixed length prefix (e.g. string length, NBT/array size, or the packet frame length itself) exceeds the maximum permitted size enforced by the reader.","commonSituations":"A malicious client sending a forged length prefix to force the server to allocate gigabytes; deserializing garbage as a length field after stream desync; a protocol-version mismatch where field layouts differ and a non-length byte is read as a length.","solutions":["Check that the peer speaks the expected protocol version so fields do not desync.","Verify the configured size limits are appropriate for your deployment (raise only with capacity planning).","Inspect the offending packet bytes; a huge length from an unknown sender usually means attack or desync — drop the connection.","Ensure compression/encryption state matches the negotiated protocol stage, which otherwise misaligns the stream."],"exampleFix":"// before: no sanity check before trusting the length\nlet len = read_var_int(stream).await?;\nlet mut buf = vec![0u8; len as usize];\n\n// after: enforce a cap\nlet len = read_var_int(stream).await?;\nif len as usize > MAX_PACKET_SIZE {\n    return Err(ReadingError::TooLarge(format!(\"packet len {len}\")));\n}\nlet mut buf = vec![0u8; len as usize];","handlingStrategy":"validation","validationCode":"// enforce limits before reading sized data\nconst MAX_STRING: i32 = 262_144;\nlet len = read_var_int(&mut r).await?;\nif !(0..=MAX_STRING).contains(&len) {\n    return Err(ReadingError::TooLarge(format!(\"string len {len}\")));\n}","typeGuard":null,"tryCatchPattern":"match decode(&mut r).await {\n    Err(ReadingError::TooLarge(what)) => {\n        warn!(\"oversized {what}; possible malicious client — dropping\");\n        connection.close().await;\n    }\n    other => /* ... */,\n}","preventionTips":["Keep protocol size limits enabled in production; never disable them for convenience.","Sanity-check that negotiated compression/encryption matches the connection stage to avoid stream desync.","Rate-limit or ban sources that repeatedly send oversized length prefixes."],"tags":["rust","protocol","limits","security","deserialization"],"backgroundTag":"payload-too-large","analyzedSha":"8d4639e25a57c15e47448ec327c780d41bbf2356","analyzedAt":"2026-09-09T15:32:22.916Z","contentChangedAt":"2026-09-09T15:32:22.916Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}