Parse a v2 envelope. - `Ok(Some((version, inner)))`: well-formed envelope. - `Ok(None)`: bytes do not begin with [`ENVELOPE_MARKER`] (treat as v1 raw). - `Err(...)`: bytes begin with [`ENVELOPE_MARKER`] but the header is truncated or the declared length overruns the buffer. We reject loudly rather than fall back to v1, because a corrupted v2 envelope must not be silently misinterpreted.
(bytes: &[u8])
| 147 | /// loudly rather than fall back to v1, because a corrupted v2 |
| 148 | /// envelope must not be silently misinterpreted. |
| 149 | fn parse_envelope(bytes: &[u8]) -> Result<Option<(u16, &[u8])>, WireVersionError> { |
| 150 | if bytes.is_empty() || bytes[0] != ENVELOPE_MARKER { |
| 151 | return Ok(None); |
| 152 | } |
| 153 | if bytes.len() < ENVELOPE_HEADER_LEN { |
| 154 | return Err(WireVersionError::DecodeFailure(format!( |
| 155 | "v2 envelope truncated: header needs {} bytes, got {}", |
| 156 | ENVELOPE_HEADER_LEN, |
| 157 | bytes.len() |
| 158 | ))); |
| 159 | } |
| 160 | let version = u16::from_be_bytes([bytes[1], bytes[2]]); |
| 161 | let inner_len = u32::from_be_bytes([bytes[3], bytes[4], bytes[5], bytes[6]]) as usize; |
| 162 | let inner_start = ENVELOPE_HEADER_LEN; |
| 163 | let inner_end = inner_start.checked_add(inner_len).ok_or_else(|| { |
| 164 | WireVersionError::DecodeFailure("v2 envelope inner length overflows usize".to_string()) |
| 165 | })?; |
| 166 | if inner_end > bytes.len() { |
| 167 | return Err(WireVersionError::DecodeFailure(format!( |
| 168 | "v2 envelope truncated: declared inner_len={inner_len}, available={}", |
| 169 | bytes.len() - inner_start |
| 170 | ))); |
| 171 | } |
| 172 | Ok(Some((version, &bytes[inner_start..inner_end]))) |
| 173 | } |
| 174 | |
| 175 | #[cfg(test)] |
| 176 | mod tests { |
no test coverage detected