fix(snapshot): validate references during preflight

commit: 46dfc775d9c8326d89a503076b3ad7474e84c298
author: brice · 3mo ago · 2026-07-12 17:18 UTC
parent: 5f5218d
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

1 file · +36 -6

M internal/usecase/snapshot/codec.go +36 -6


@@ -649,10 +649,12 @@ func preflightTab(r payloadReader, totals vt.DecodeStats, blobs *uint64, budge
649	649		if _, err := r.getUint64(); err != nil {
650	650		return err
651	651		}
652		-	if err := skipString(r); err != nil {
	652	+	focus, err := r.getString()
	653	+	if err != nil {
653	654		return err
654	655		}
655		-	if err := preflightNode(r, 0, budget); err != nil {
	656	+	references := preflightTreeReferences{}
	657	+	if err := preflightNode(r, 0, budget, &references); err != nil {
656	658		return err
657	659		}
658	660		panes, err := r.getUint16()

@@ -668,10 +670,28 @@ func preflightTab(r payloadReader, totals vt.DecodeStats, blobs *uint64, budge
668	670		return err
669	671		}
670	672		}
	673	+	if focus != "" {
	674	+	references.ids = append(references.ids, layout.PaneID(focus))
	675	+	}
	676	+	for _, id := range references.ids {
	677	+	if _, ok := ids[id]; !ok {
	678	+	return ErrUnknownPane
	679	+	}
	680	+	}
	681	+	return nil
	682	+	}
	683	+
	684	+	type preflightTreeReferences struct{ ids []layout.PaneID }
	685	+
	686	+	func (r preflightTreeReferences) add(id layout.PaneID, budget preflightBudget) error {
	687	+	if !budget.addAllocation(32) {
	688	+	return fmt.Errorf("%w: decoded allocation budget", ErrInvalidData)
	689	+	}
	690	+	r.ids = append(r.ids, id)
671	691		return nil
672	692		}
673	693
674		-	func preflightNode(r payloadReader, depth int, budget preflightBudget) error {
	694	+	func preflightNode(r payloadReader, depth int, budget preflightBudget, references *preflightTreeReferences) error {
675	695		if depth > 64 {
676	696		return fmt.Errorf("%w: tree depth", ErrInvalidData)
677	697		}

@@ -684,15 +704,25 @@ func preflightNode(r payloadReader, depth int, budget preflightBudget) error {
684	704		}
685	705		switch kind {
686	706		case 0:
687		-	return skipString(r)
	707	+	leaf, err := r.getString()
	708	+	if err != nil {
	709	+	return err
	710	+	}
	711	+	return references.add(layout.PaneID(leaf), budget)
688	712		case 1:
689	713		if _, err := r.getUint8(); err != nil {
690	714		return err
691	715		}
692	716		case 2:
693		-	if err := skipString(r); err != nil {
	717	+	expanded, err := r.getString()
	718	+	if err != nil {
694	719		return err
695	720		}
	721	+	if expanded != "" {
	722	+	if err := references.add(layout.PaneID(expanded), budget); err != nil {
	723	+	return err
	724	+	}
	725	+	}
696	726		case 3:
697	727		return nil
698	728		default:

@@ -706,7 +736,7 @@ func preflightNode(r payloadReader, depth int, budget preflightBudget) error {
706	736		return ErrShortPayload
707	737		}
708	738		for range children {
709		-	if err := preflightNode(r, depth+1, budget); err != nil {
	739	+	if err := preflightNode(r, depth+1, budget, references); err != nil {
710	740		return err
711	741		}
712	742		}

 	if _, err := r.getUint64(); err != nil {
 		return err
 	}
-	if err := skipString(r); err != nil {
+	focus, err := r.getString()
+	if err != nil {
 		return err
 	}
-	if err := preflightNode(r, 0, budget); err != nil {
+	references := preflightTreeReferences{}
+	if err := preflightNode(r, 0, budget, &references); err != nil {
 		return err
 	}
 	panes, err := r.getUint16()
 			return err
 		}
 	}
+	if focus != "" {
+		references.ids = append(references.ids, layout.PaneID(focus))
+	}
+	for _, id := range references.ids {
+		if _, ok := ids[id]; !ok {
+			return ErrUnknownPane
+		}
+	}
+	return nil
+}
+type preflightTreeReferences struct{ ids []layout.PaneID }
+func (r *preflightTreeReferences) add(id layout.PaneID, budget *preflightBudget) error {
+	if !budget.addAllocation(32) {
+		return fmt.Errorf("%w: decoded allocation budget", ErrInvalidData)
+	}
+	r.ids = append(r.ids, id)
 	return nil
 }
-func preflightNode(r *payloadReader, depth int, budget *preflightBudget) error {
+func preflightNode(r *payloadReader, depth int, budget *preflightBudget, references *preflightTreeReferences) error {
 	if depth > 64 {
 		return fmt.Errorf("%w: tree depth", ErrInvalidData)
 	}
 	}
 	switch kind {
 	case 0:
-		return skipString(r)
+		leaf, err := r.getString()
+		if err != nil {
+			return err
+		}
+		return references.add(layout.PaneID(leaf), budget)
 	case 1:
 		if _, err := r.getUint8(); err != nil {
 			return err
 		}
 	case 2:
-		if err := skipString(r); err != nil {
+		expanded, err := r.getString()
+		if err != nil {
 			return err
 		}
+		if expanded != "" {
+			if err := references.add(layout.PaneID(expanded), budget); err != nil {
+				return err
+			}
+		}
 	case 3:
 		return nil
 	default:
 		return ErrShortPayload
 	}
 	for range children {
-		if err := preflightNode(r, depth+1, budget); err != nil {
+		if err := preflightNode(r, depth+1, budget, references); err != nil {
 			return err
 		}
 	}