What the developer wrote
Authored by Abeeujah
Update `ArrayVec` deserialization
Deserialization of ArrayVec now uses `ArrayVec::try_push` method
over the `ArrayVec::push` method, which would panic if the array
is full, causing us to manually check for capacity before pushing.
The `try_push` method returns a `Result` which is mapped to Serde's
`invalid_length` error.
What changed, and why it matters
This commit fixes a deserialization bug in an internal array-like data structure. Previously, if untrusted serialized data claimed to contain more items than the structure could hold, the code would panic (crash) instead of returning a proper error. The fix makes deserialization gracefully reject oversized input.
No immediate action required beyond applying the patch. Users relying on `ArrayVec` deserialization from untrusted sources should upgrade to a version containing this commit. No CVE or advisory is indicated by the commit materials.
Security signals we found
Potential denial-of-service via panic on maliciously crafted oversized serialized input
Deserialization of untrusted data without graceful error handling
Refactoring to use fallible API (`try_push`) instead of panicking API (`push`)
Maintains existing `invalid_length` error behavior
Evidence from the diff
The change replaces a manual capacity check followed by ArrayVec::push with ArrayVec::try_push, mapping its error to Serde’s invalid_length error. The old code’s explicit check was intended to prevent a panic, but the new approach is cleaner and more idiomatic while preserving the same security property: deserialization of an over-length sequence returns an error rather than panicking. This is a defensive hardening/refactoring patch with no evidence of an exploitable vulnerability beyond denial-of-service via panic.
Changed components
internals/src/array_vec.rsArrayVec deserialization visitorInspect captured patch +1 / −5
diff --git a/internals/src/array_vec.rs b/internals/src/array_vec.rs
index ab5a977a..e278afda 100644
--- a/internals/src/array_vec.rs
+++ b/internals/src/array_vec.rs
@@ -274,11 +274,7 @@ where
let mut out = ArrayVec::<T, CAP>::new();
while let Some(elem) = seq.next_element::<T>()? {
- // The `push()` call below panics if array is full but we want to error.
- if out.len() >= CAP {
- return Err(Error::invalid_length(out.len() + 1, &self));
- }
- out.push(elem);
+ out.try_push(elem).map_err(|_| Error::invalid_length(out.len() + 1, &self))?;
}
Ok(out)
}
Why this scored 44/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.