Struct Budget 

pub struct Budget { /* private fields */ }

A per-read traversal budget — an opt-in guard against amplification-DoS on untrusted messages (the wire spec §5.2). Veritate’s offsets are absolute and may alias, so a small hostile message can point many fields at the same large sub-object and make a naive full read do work super-linear in the message’s own size. Memory safety (bounds, depth, allocation) always holds; a Budget additionally caps total work.

Create one per message read and open the root with Message::root_bounded. Every byte a read touches through the buffer is charged against the budget; because aliased sub-objects are charged on every visit, total work is capped regardless of how offsets alias. When exhausted, reads fail with Error::TraversalBudgetExceeded instead of running away. A good starting limit is Message::suggested_budget.

let msg = Message::parse(buf)?;
let budget = Budget::new(msg.suggested_budget());
let root = msg.root_bounded(resolver, &budget)?;
// ... traverse `root`; any amplification trips TraversalBudgetExceeded ...

Implementations

impl Budget

pub fn new(limit: u64) -> Self

A budget that allows limit total bytes of buffer access before tripping.

pub fn remaining(&self) -> u64

Bytes still allowed before the budget trips.

pub fn charge(&self, bytes: u64) -> Result<()>

Charge bytes against the budget, returning Error::TraversalBudgetExceeded if it would go negative. Public so generated code (see crate::wire) can charge its own buffer accesses.

Trait Implementations

impl Debug for Budget

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.