1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
//! Error types for buffa encoding and decoding operations.
/// An error that occurred while decoding a protobuf message.
#[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]
#[non_exhaustive]
pub enum DecodeError {
/// The buffer ended before a complete value could be read.
#[error("unexpected end of buffer")]
UnexpectedEof,
/// A varint exceeded the maximum encoded length of 10 bytes.
#[error("varint exceeded maximum length of 10 bytes")]
VarintTooLong,
/// The wire type in a tag was not a recognised protobuf wire type.
///
/// Carries the raw 3-bit value from the tag for diagnostic purposes.
#[error("invalid wire type: {0}")]
InvalidWireType(u32),
/// The field number decoded from a tag was zero, or the tag varint
/// overflowed a `u32` — both indicate a malformed message.
#[error("invalid field number")]
InvalidFieldNumber,
/// The message or sub-message length exceeded the configured size limit.
///
/// By default, the limit is 2 GiB. Use [`DecodeOptions::with_max_message_size`](crate::DecodeOptions::with_max_message_size)
/// to set a lower limit for untrusted input.
#[error("message length exceeds configured size limit")]
MessageTooLarge,
/// The wire type of an incoming field did not match the type expected for
/// that field number.
///
/// Carries the field number and the raw wire type values (as `u8` to keep
/// this type independent of the encoding module).
#[error("wire type mismatch on field {field_number}: expected {expected}, got {actual}")]
WireTypeMismatch {
field_number: u32,
expected: u8,
actual: u8,
},
/// A `string` field contained bytes that are not valid UTF-8.
#[error("invalid UTF-8 in string field")]
InvalidUtf8,
/// The message nesting depth exceeded the recursion limit.
#[error("recursion limit exceeded")]
RecursionLimitExceeded,
/// An EndGroup tag was encountered with a field number that does not match
/// the opening StartGroup tag, or an EndGroup was seen outside of a group.
#[error("invalid end-group tag: field number {0}")]
InvalidEndGroup(u32),
/// A MessageSet `Item` group was malformed (missing or out-of-range
/// `type_id`). Only occurs for messages declared with
/// `option message_set_wire_format = true`.
#[error("invalid MessageSet item: {0}")]
InvalidMessageSet(&'static str),
/// Decoding encountered more unknown fields than the configured limit.
///
/// Unknown fields can be far smaller on the wire than in memory (a
/// 2-byte varint field occupies ~40 bytes as an
/// [`UnknownField`](crate::UnknownField)), so the decoder bounds how
/// many it will materialize rather than trusting the input size. By
/// default the limit is
/// [`DEFAULT_UNKNOWN_FIELD_LIMIT`](crate::DEFAULT_UNKNOWN_FIELD_LIMIT)
/// (1,000,000 fields per decode); use
/// [`DecodeOptions::with_unknown_field_limit`](crate::DecodeOptions::with_unknown_field_limit)
/// to raise it for trusted inputs that legitimately carry very many
/// unknown fields.
#[error("unknown field limit exceeded")]
UnknownFieldLimitExceeded,
/// A custom `string`/`bytes` representation rejected the decoded payload in
/// its [`from_wire`](crate::ProtoString::from_wire) constructor — for
/// example a length or domain check beyond UTF-8 validation. Carries a
/// static reason for diagnostics (mirroring [`InvalidMessageSet`]).
///
/// Only produced by user-supplied [`ProtoString`](crate::ProtoString) /
/// [`ProtoBytes`](crate::ProtoBytes) impls; the built-in representations
/// never return it.
///
/// [`InvalidMessageSet`]: DecodeError::InvalidMessageSet
#[error("custom representation rejected the field value: {0}")]
Custom(&'static str),
}
/// An error that occurred while encoding a protobuf message.
///
/// Currently uninhabited — encoding is infallible with the present
/// implementation. The type is retained and `#[non_exhaustive]` for forward
/// compatibility: if a fallible encode path is added in future (e.g.
/// `try_encode` with a fixed-capacity buffer), new variants will be added
/// here without a breaking change to the type name.
#[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]
#[non_exhaustive]
pub enum EncodeError {}