{"record":{"id":"b1621ba7bc9a9402","repo":"Pumpkin-MC/Pumpkin","slug":"too-many-resource-pack-identifiers","errorCode":null,"errorMessage":"too many resource pack identifiers","messagePattern":"too many resource pack identifiers","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/pumpkin-protocol/src/bedrock/server/resource_pack_client_response.rs","lineNumber":27,"sourceCode":"    pub download_size: u16,\n    pub pack_ids: Vec<String>,\n}\n\nimpl PacketRead for SResourcePackClientResponse {\n    fn read<R: Read>(reader: &mut R) -> Result<Self, Error> {\n        let encoded_status = VarUInt::read(reader)?.0;\n        let response = encoded_status\n            .checked_add(1)\n            .and_then(|v| u8::try_from(v).ok())\n            .ok_or_else(|| {\n                Error::new(ErrorKind::InvalidData, \"resource pack status is too large\")\n            })?;\n        let _status_name = String::read(reader)?;\n\n        let pack_ids = if response == Self::STATUS_SEND_PACKS {\n            let count = VarUInt::read(reader)?.0;\n            if count > 1024 {\n                return Err(Error::new(\n                    ErrorKind::InvalidData,\n                    \"too many resource pack identifiers\",\n                ));\n            }\n            (0..count)\n                .map(|_| String::read(reader))\n                .collect::<Result<Vec<_>, _>>()?\n        } else {\n            Vec::new()\n        };\n        let download_size = u16::try_from(pack_ids.len()).map_err(|_| {\n            Error::new(ErrorKind::InvalidData, \"too many resource pack identifiers\")\n        })?;\n\n        Ok(Self {\n            response,\n            download_size,\n            pack_ids,","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/Pumpkin-MC/Pumpkin/blob/8d4639e25a57c15e47448ec327c780d41bbf2356/crates/pumpkin-protocol/src/bedrock/server/resource_pack_client_response.rs#L9-L45","documentation":"Guard in SResourcePackClientResponse::read raising a generic InvalidData error when the packet declares more resource pack identifiers than allowed, protecting against oversized hostile client responses.","triggerScenarios":"Client responds with pack ids where the VarUInt count field exceeds 1024.","commonSituations":"Buggy clients echoing oversized pack lists, modded clients, or protocol desync reading unrelated data as the count.","solutions":["Reject the resource-pack response packet","Keep the identifier count limit and reserve bounded capacity","Log the violation at debug level"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"let count = VarUInt::read(r)?.0;\nif count > 1024 { return Err(...); }","typeGuard":null,"tryCatchPattern":"if let Err(e) = resp.read(reader) {\n    if e.kind() == std::io::ErrorKind::InvalidData { metrics.pack_limit_hits.inc(); disconnect(peer); }\n}","preventionTips":["Send clients only the packs the server actually has, keeping id lists small","Bound every VarUInt-derived collection in decoders","Test the resource-pack flow end-to-end after client updates"],"tags":["bedrock","protocol","resource-packs","length-validation"],"backgroundTag":"value-out-of-range","analyzedSha":"8d4639e25a57c15e47448ec327c780d41bbf2356","analyzedAt":"2026-09-09T15:32:22.916Z","contentChangedAt":"2026-09-09T15:32:22.916Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}