fix(proto): reject packet lengths usize cannot represent

crates/irtt-proto/src/echo.rs

@@ -66,7 +66,7 @@ pub fn encode_echo_reply(
     hmac_key: Option<&[u8]>,
 ) -> Result<Vec<u8>> {
     let layout = PacketLayout::echo(hmac_key.is_some(), params);
-    let len = echo_packet_len(hmac_key.is_some(), params);
+    let len = echo_packet_len(hmac_key.is_some(), params)?;
     let payload_offset = layout.header_len();
     let available_payload_len = len.saturating_sub(payload_offset);
     if reply.payload.len() > available_payload_len {
@@ -186,7 +186,7 @@ fn validate_echo_length(packet: &[u8], params: &Params, layout: PacketLayout) ->
             actual: packet.len(),
         });
     }
-    let expected_len = echo_packet_len(layout.hmac, params);
+    let expected_len = echo_packet_len(layout.hmac, params)?;
     if packet.len() == expected_len {
         return Ok(false);
     }
@@ -396,7 +396,7 @@ mod tests {
         };
         params.received_stats = ReceivedStats::Both;
         let layout = PacketLayout::echo(true, &params);
-        let mut packet = Vec::with_capacity(echo_packet_len(true, &params));
+        let mut packet = Vec::with_capacity(echo_packet_len(true, &params).unwrap());
         write_header(&mut packet, FLAG_REPLY | FLAG_HMAC);
         packet.extend_from_slice(&[0; HMAC_SIZE]);
         packet.extend_from_slice(&0x7896_b6ab_8771_5213u64.to_le_bytes());

crates/irtt-proto/src/error.rs

@@ -30,6 +30,8 @@ pub enum ProtoError {
     InvalidUtf8,
     #[error("invalid enum value {value} for {name}")]
     InvalidEnum { name: &'static str, value: i64 },
+    #[error("packet length {length} cannot be represented as a buffer length")]
+    PacketLengthUnrepresentable { length: i64 },
     #[error("parameter {tag} length is too large: {length} bytes")]
     ParameterLengthTooLarge { tag: u64, length: u64 },
     #[error("open reply has zero token without close flag")]

crates/irtt-proto/src/layout.rs

@@ -1,7 +1,7 @@
 use crate::{
     params::{Params, StampAt},
-    HEADER_SIZE, HMAC_SIZE, RECV_COUNT_SIZE, RECV_WINDOW_SIZE, SEQ_SIZE, TIMESTAMP_SIZE,
-    TOKEN_SIZE,
+    ProtoError, Result, HEADER_SIZE, HMAC_SIZE, RECV_COUNT_SIZE, RECV_WINDOW_SIZE, SEQ_SIZE,
+    TIMESTAMP_SIZE, TOKEN_SIZE,
 };
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -123,18 +123,30 @@ pub fn echo_header_len(hmac: bool, params: &Params) -> usize {
 /// therefore requests no space beyond the mandatory field block, exactly as
 /// zero does.
 ///
-/// Only the negative end is bounded. An absurdly large positive length is
-/// returned as asked, and encoding a packet that size fails in the allocator
-/// rather than here — on a 64-bit target every positive `i64` converts, so that
-/// has always been true of a length beyond addressable memory. Capping a
-/// negotiated length to something a UDP datagram can actually be belongs with
-/// the deferred maximum-packet-length policy, which would apply long before
-/// this conversion.
-pub fn echo_packet_len(hmac: bool, params: &Params) -> usize {
-    // Saturating keeps the same answer on a target whose `usize` is narrower
-    // than the length: still unallocatable, just unrepresentable sooner.
-    let requested = usize::try_from(params.length.max(0)).unwrap_or(usize::MAX);
-    echo_header_len(hmac, params).max(requested)
+/// # Errors
+///
+/// Returns [`ProtoError::PacketLengthUnrepresentable`] for a positive length
+/// this platform's `usize` cannot hold. That is a representability check, not a
+/// size policy: a wire value that cannot even name a local buffer must not be
+/// converted into one that can, because the result is handed to an allocator.
+/// It is unreachable on a 64-bit target, where every positive `i64` converts,
+/// and is the reason this returns a [`Result`] at all.
+///
+/// A ceiling on what a negotiated length may legitimately *be* — an MTU, a
+/// resource bound, a maximum packet size — is deliberately not here. That is
+/// server and runtime policy, and it belongs where the negotiation happens.
+pub fn echo_packet_len(hmac: bool, params: &Params) -> Result<usize> {
+    let header_len = echo_header_len(hmac, params);
+    let requested = if params.length <= 0 {
+        // No datagram is shorter than none, so a negative length asks for
+        // nothing beyond the mandatory field block, exactly as zero does.
+        0
+    } else {
+        usize::try_from(params.length).map_err(|_| ProtoError::PacketLengthUnrepresentable {
+            length: params.length,
+        })?
+    };
+    Ok(header_len.max(requested))
 }
 
 #[cfg(test)]
@@ -304,9 +316,26 @@ mod tests {
             p.length = length;
             assert_eq!(
                 echo_packet_len(false, &p),
-                expected,
+                Ok(expected),
                 "unexpected packet length for negotiated length {length}"
             );
         }
     }
+
+    /// A positive length wider than `usize` must stay an error rather than
+    /// becoming a saturated buffer size. Only reachable where `usize` is
+    /// narrower than `i64`; on a 64-bit target every positive `i64` converts.
+    #[cfg(target_pointer_width = "32")]
+    #[test]
+    fn a_length_wider_than_usize_is_rejected_rather_than_saturated() {
+        let mut p = params(ReceivedStats::Both, StampAt::Both, Clock::Both);
+        p.length = 5_000_000_000;
+
+        assert_eq!(
+            echo_packet_len(false, &p),
+            Err(ProtoError::PacketLengthUnrepresentable {
+                length: 5_000_000_000
+            })
+        );
+    }
 }

crates/irtt-proto/src/request.rs

@@ -84,8 +84,10 @@ pub enum DecodedRequestKind<'a> {
 /// # Errors
 ///
 /// Returns [`ProtoError::PayloadTooLarge`] when an ECHO payload does not fit
-/// the negotiated length. A negative negotiated length is not an error: see
-/// [`echo_packet_len`], which floors it at the mandatory field block.
+/// the negotiated length, and [`ProtoError::PacketLengthUnrepresentable`] when
+/// the negotiated length is positive and wider than `usize`. A *negative*
+/// negotiated length is not an error: see [`echo_packet_len`], which floors it
+/// at the mandatory field block.
 pub fn encode_request(request: RequestToEncode<'_>, hmac_key: Option<&[u8]>) -> Result<Vec<u8>> {
     match request {
         RequestToEncode::Open { params, no_test } => encode_open(params, no_test, hmac_key),
@@ -205,7 +207,7 @@ fn encode_echo(
     hmac_key: Option<&[u8]>,
 ) -> Result<Vec<u8>> {
     let layout = PacketLayout::echo(hmac_key.is_some(), params);
-    let len = echo_packet_len(hmac_key.is_some(), params);
+    let len = echo_packet_len(hmac_key.is_some(), params)?;
     let payload_offset = layout.header_len();
     let available_payload_len = len.saturating_sub(payload_offset);
     if payload.len() > available_payload_len {

crates/irtt-proto/tests/directional_codecs.rs

@@ -316,7 +316,7 @@ fn a_negative_negotiated_length_still_encodes_in_both_directions() {
         length: -4096,
         ..Params::default()
     };
-    assert_eq!(echo_packet_len(false, &params), 16);
+    assert_eq!(echo_packet_len(false, &params), Ok(16));
 
     let request = encode_request(echo_request(&params, &[]), None)
         .expect("a negative negotiated length must still encode a request");
@@ -372,7 +372,7 @@ fn midpoint_params(clock: Clock, payload_space: usize) -> Params {
 
 fn midpoint_compat_len(params: &Params, hmac: bool) -> usize {
     let compat_header = PacketLayout::echo(hmac, params).header_len() + 8;
-    compat_header.max(echo_packet_len(hmac, params))
+    compat_header.max(echo_packet_len(hmac, params).unwrap())
 }
 
 /// Hand-builds upstream's dual-midpoint ECHO reply: both midpoint fields on
@@ -425,7 +425,7 @@ fn midpoint_dual_field_reply_is_accepted_wherever_length_identifies_it() {
     for (payload_space, expected_extra) in [(0, 8), (1, 7), (4, 4), (7, 1)] {
         for clock in [Clock::Wall, Clock::Monotonic] {
             let params = midpoint_params(clock, payload_space);
-            let normal_len = echo_packet_len(false, &params);
+            let normal_len = echo_packet_len(false, &params).unwrap();
             let packet = build_midpoint_dual_field_reply(&params, FLAG_REPLY, 3, (111, 222), None);
             assert_eq!(
                 packet.len(),
@@ -464,7 +464,7 @@ fn midpoint_dual_field_reply_of_equal_length_is_accepted_but_not_correctable() {
     for payload_space in [8, 64] {
         for clock in [Clock::Wall, Clock::Monotonic] {
             let params = midpoint_params(clock, payload_space);
-            let normal_len = echo_packet_len(false, &params);
+            let normal_len = echo_packet_len(false, &params).unwrap();
             let packet = build_midpoint_dual_field_reply(&params, FLAG_REPLY, 4, (111, 222), None);
             assert_eq!(
                 packet.len(),
@@ -517,7 +517,7 @@ fn midpoint_dual_field_reply_authenticates_over_full_packet() {
 fn only_the_exact_compat_length_is_accepted_as_an_extension() {
     let params = midpoint_params(Clock::Wall, 0);
     let packet = build_midpoint_dual_field_reply(&params, FLAG_REPLY, 1, (10, 20), None);
-    let expected_len = echo_packet_len(false, &params);
+    let expected_len = echo_packet_len(false, &params).unwrap();
     assert_eq!(packet.len(), expected_len + 8);
 
     // Every other length around the compatibility size stays rejected,