Skip to content

Fix decode_array double-reading length bytes for arrays with 24+ items#479

Merged
cffls merged 1 commit intoPython-Cardano:mainfrom
cffls:fix_decode_array
Feb 28, 2026
Merged

Fix decode_array double-reading length bytes for arrays with 24+ items#479
cffls merged 1 commit intoPython-Cardano:mainfrom
cffls:fix_decode_array

Conversation

@cffls
Copy link
Collaborator

@cffls cffls commented Feb 28, 2026

The custom decode_array override in serialization.py called _decode_length to check for indefinite-length arrays, then delegated to the original decode_array which called _decode_length again. For arrays with fewer than 24 items, the length is encoded directly in the subtype (no stream bytes consumed), so the double call was harmless. For 24+ items, CBOR uses multi-byte length encoding (e.g. 98 18 for 24 items) and _decode_length reads from the stream — the second call consumed actual array content as a length byte, corrupting the decode.

Replace the _decode_length call with a simple subtype == 31 check, which is sufficient to detect indefinite-length arrays without consuming any bytes from the stream.

This bug only affected cbor2pure, not the cbor2 C extension.

The custom decode_array override in serialization.py called _decode_length
to check for indefinite-length arrays, then delegated to the original
decode_array which called _decode_length again. For arrays with fewer than
24 items, the length is encoded directly in the subtype (no stream bytes
consumed), so the double call was harmless. For 24+ items, CBOR uses
multi-byte length encoding (e.g. 98 18 for 24 items) and _decode_length
reads from the stream — the second call consumed actual array content as
a length byte, corrupting the decode.

Replace the _decode_length call with a simple subtype == 31 check, which
is sufficient to detect indefinite-length arrays without consuming any
bytes from the stream.

This bug only affected cbor2pure, not the cbor2 C extension.
@codecov
Copy link

codecov bot commented Feb 28, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.60%. Comparing base (8946e19) to head (d342861).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #479      +/-   ##
==========================================
- Coverage   90.61%   90.60%   -0.01%     
==========================================
  Files          34       34              
  Lines        5155     5154       -1     
  Branches      781      781              
==========================================
- Hits         4671     4670       -1     
  Misses        305      305              
  Partials      179      179              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@cffls cffls merged commit 1d2e825 into Python-Cardano:main Feb 28, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant