{"record":{"id":"ddce2b3f70b55472","repo":"ruvnet/ruflo","slug":"buffer-too-small-for-declared-header","errorCode":null,"errorMessage":"Buffer too small for declared header","messagePattern":"Buffer too small for declared header","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/cli/src/appliance/rvfa-distribution.ts","lineNumber":197,"sourceCode":"      const signable = Buffer.concat([Buffer.from(canonicalJson(header), 'utf-8'), payload]);\n      header.signature = edSign(signable, opts.privateKey);\n      header.signedBy = opts.signedBy;\n    }\n    const hJson = Buffer.from(JSON.stringify(header), 'utf-8');\n    const magic = Buffer.from('RVFP');\n    const ver = Buffer.alloc(4); ver.writeUInt32LE(RVFP_VERSION, 0);\n    const hLen = Buffer.alloc(4); hLen.writeUInt32LE(hJson.length, 0);\n    return Buffer.concat([magic, ver, hLen, hJson, payload, sha256B(payload)]);\n  }\n\n  static parsePatchHeader(buf: Buffer): RvfpHeader {\n    if (buf.length < PRE) throw new Error('Buffer too small for RVFP preamble');\n    const magic = buf.subarray(0, 4).toString('ascii');\n    if (magic !== 'RVFP') throw new Error(`Invalid RVFP magic: \"${magic}\"`);\n    const ver = buf.readUInt32LE(4);\n    if (ver !== RVFP_VERSION) throw new Error(`Unsupported RVFP version: ${ver}`);\n    const hLen = buf.readUInt32LE(8);\n    if (PRE + hLen > buf.length) throw new Error('Buffer too small for declared header');\n    const h = JSON.parse(buf.subarray(PRE, PRE + hLen).toString('utf-8')) as RvfpHeader;\n    if (h.magic !== 'RVFP') throw new Error('RVFP header magic mismatch');\n    return h;\n  }\n\n  static async verifyPatch(buf: Buffer): Promise<PatchVerifyResult> {\n    const errors: string[] = [];\n    let header: RvfpHeader;\n    try { header = RvfaPatcher.parsePatchHeader(buf); } catch (e) {\n      const empty: RvfpHeader = {\n        magic: 'RVFP', version: 0, targetApplianceName: '', targetApplianceVersion: '',\n        targetSection: '', patchVersion: '', created: '', newSectionSize: 0,\n        newSectionSha256: '', compression: 'none',\n      };\n      return { valid: false, header: empty, errors: [(e as Error).message] };\n    }\n    const { start, end, section } = patchData(buf);\n    if (end < start) {","sourceCodeStart":179,"sourceCodeEnd":215,"githubUrl":"https://github.com/ruvnet/ruflo/blob/6b01dc5a687b26b3e218f796de45ec51f8fa9e8c/v3/@claude-flow/cli/src/appliance/rvfa-distribution.ts#L179-L215","documentation":"Thrown by parsePatchHeader() when PRE(12) + declared header length exceeds the buffer length. The preamble's header-length field claims more JSON than the buffer actually contains, so reading the header slice would run past the end. This catches truncated headers and implausibly large (possibly corrupt) length fields before JSON.parse is attempted.","triggerScenarios":"A patch whose header JSON was truncated after the preamble (e.g. partial download), or a corrupted 4-byte header-length field that encodes an oversized value. The magic and version checks already passed.","commonSituations":"Interrupted IPFS fetch of a patch; a write that was killed mid-flush; bit-rot on the length field; a patch that was sliced by a proxy with a body-size limit.","solutions":["Re-fetch or regenerate the patch from a known-good source.","Compare the file size against the producer's reported size before parsing.","If you control the producer, log the expected total size alongside the patch for round-trip checks.","Reject files whose preamble header-length field exceeds the remaining buffer size."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const RVFP_PRE = 12;\nfunction patchHeaderFits(buf: Buffer): boolean {\n  if (buf.length < RVFP_PRE) return false;\n  const hLen = buf.readUInt32LE(8);\n  return RVFP_PRE + hLen <= buf.length;\n}","typeGuard":null,"tryCatchPattern":"try {\n  const header = RvfaPatcher.parsePatchHeader(buf);\n} catch (e) {\n  if (/Buffer too small for declared header/.test((e as Error).message)) {\n    throw new Error('Patch header region is truncated; re-fetch or regenerate the .rvfp');\n  }\n  throw e;\n}","preventionTips":["Compare downloaded patch size against the producer's manifest.","Use content-addressed storage (IPFS CIDs) so truncation is detectable.","Run verifyPatch() on received patches to confirm the SHA256 footer.","Reject partial writes by writing patches atomically (tmp + rename)."],"tags":["rvfp","buffer","truncation","binary-format"],"backgroundTag":null,"analyzedSha":"6b01dc5a687b26b3e218f796de45ec51f8fa9e8c","analyzedAt":"2026-08-12T13:20:50.148Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}