Function put_expr

crates/ixon/src/serialize.rs:133–232

Serialize an expression to bytes (iterative to avoid stack overflow).

(e: &Expr, buf: &mut Vec<u8>)

  // hold is corruption (or a stale format) — reject before allocating.
  if n > buf.len() / 32 {
    return Err(format!(
      "{ctx}: assumption count {n} exceeds remaining buffer — corrupt or \
       pre-bundle-format .ixe"
    ));
  }
  let mut assumptions: Vec<Address> = Vec::with_capacity(n);
  for i in 0..n {
    let addr = get_address(buf)?;
    if let Some(prev) = assumptions.last()
      && *prev >= addr
    {
      return Err(format!(
        "{ctx}: assumptions not strictly ascending at idx {i} ({} then {})",
        prev.hex(),
        addr.hex()
      ));
    }
    assumptions.push(addr);
  }
  Ok((stored_root, main, assumptions))
}

/// Read the §1 blob section, verifying `Address::hash(bytes) == addr`
/// per entry. Without the check a swapped blob would silently change a
/// Nat/String literal's value under an otherwise-valid file (the consts
/// merkle root covers only const addresses).
fn read_blob_section(
  buf: &mut &[u8],
  ctx: &str,
) -> Result<Vec<(Address, Vec<u8>)>, String> {
  let num_blobs = get_u64(buf)? as usize;
  // Each blob entry needs at least addr (32) + a length byte.
  if num_blobs > buf.len() / 33 {
    return Err(format!(
      "{ctx}: blob count {num_blobs} exceeds remaining buffer"
    ));
  }
  let mut blobs = Vec::with_capacity(num_blobs);
  for i in 0..num_blobs {
    let addr = get_address(buf)?;
    let len = get_u64(buf)? as usize;
    if buf.len() < len {
      return Err(format!(
        "{ctx}: need {} bytes for blob, have {}",
        len,
        buf.len()
      ));
    }
    let (bytes, rest) = buf.split_at(len);
    *buf = rest;
    let computed = Address::hash(bytes);
    if computed != addr {
      return Err(format!(
        "{ctx}: blob at idx {i} bytes hash to {} but stored under {}",
        computed.hex(),
        addr.hex()
      ));
    }