Repository navigation
refset: draft readers silently discard partial trailing values #261
Description
Dsref and MtpSet decode f32 and i32 files with as_chunks::<4>().0, discarding the remainder. Their bytes helpers (dsref.rs:541 and mtpref.rs:612) only read the file, and the callers check the decoded value count. A row expecting n values therefore accepts 4n+1, 4n+2 or 4*n+3 bytes and returns the same values as a valid file. Reject partial elements before decoding with a named Malformed error. Add cases that append one, two and three bytes to valid f32 and i32 files and require refusal.
Evidence (at the base of #242):
- crates/refset/src/dsref.rs:482
- crates/refset/src/dsref.rs:573
- crates/refset/src/mtpref.rs:553
- crates/refset/src/mtpref.rs:637
Filed by Shingler, the review bot, while reviewing #242; the defect is outside that pull request.
Activity
Burntgogi commentedon Oct 15, 2026
Implemented in PR #274: one shared aligned-file reader rejects 1–3 trailing bytes before DSpark/MTP f32 or i32 decoding. All four consumer regressions fail before the fix; after it refset has 216 passed, 3 ignored. A public Dsref consumer also reads valid data and refuses the 9/10/11-byte variants with named Malformed errors. Combined five-fix T0: 83 units, 0 red. Existing strict-lint blockers and the independent decoder move in #242 are disclosed in the PR.
refset: reject partial trailing values in draft files