advance out of bounds: the len is 3 but advancing by 4

use std::panic;

use bytes::{Buf, Bytes, BytesMut};

fn main() {
  panic::set_hook(Box::new(|info| {
    let msg = info.payload().downcast_ref::<String>().cloned()
      .or_else(|| info.payload().downcast_ref::<&str>().map(|s| s.to_string()))
      .unwrap_or_default();
    let loc = info.location().unwrap();
    let file = loc.file().rsplit("bytes-1.12.1/").next().unwrap();
    println!("    at {file}:{}: {msg}", loc.line());
  }));
  let three = || BytesMut::from(&[1u8, 2, 3][..]);
  let cases: Vec<(&str, Box<dyn Fn()>)> = vec![
    ("BytesMut get_u32()", Box::new(move || { three().get_u32(); })),
    ("Bytes get_u16_le() x2", Box::new(|| { let mut b = Bytes::from_static(&[1, 2, 3]); b.get_u16_le(); b.get_u16_le(); })),
    ("&[u8] copy_to_slice(&mut [0; 4])", Box::new(|| (&[1u8, 2, 3][..]).copy_to_slice(&mut [0; 4]))),
    ("BytesMut advance(5)", Box::new(move || three().advance(5))),
    ("Bytes advance(5)", Box::new(|| Bytes::from_static(&[1, 2, 3]).advance(5))),
    ("&[u8] advance(5)", Box::new(|| (&[1u8, 2, 3][..]).advance(5))),
  ];
  for (name, f) in cases {
    println!("{name}");
    let _ = panic::catch_unwind(panic::AssertUnwindSafe(f));
  }
  let mut b = three();
  let e = b.try_get_u32().unwrap_err();
  println!("try_get_u32(): Err({e:?}), remaining = {}", b.remaining());
  println!("Display: {e}");
}

BytesMut get_u32()
    at src/lib.rs:207: advance out of bounds: the len is 3 but advancing by 4
Bytes get_u16_le() x2
    at src/lib.rs:207: advance out of bounds: the len is 1 but advancing by 2
&[u8] copy_to_slice(&mut [0; 4])
    at src/lib.rs:207: advance out of bounds: the len is 3 but advancing by 4
BytesMut advance(5)
    at src/bytes_mut.rs:1246: cannot advance past `remaining`: 5 <= 3
Bytes advance(5)
    at src/bytes.rs:694: cannot advance past `remaining`: 5 <= 3
&[u8] advance(5)
    at src/lib.rs:207: advance out of bounds: the len is 3 but advancing by 5
try_get_u32(): Err(TryGetError { requested: 4, available: 3 }), remaining = 3
Display: Not enough bytes remaining in buffer to read value (requested 4 but only 3 available)

/// Panic with a nice error message.
#[cold]
fn panic_advance(error_info: &TryGetError) -> ! {
    panic!(
        "advance out of bounds: the len is {} but advancing by {}",
        error_info.available, error_info.requested
    );
}

use std::panic;

use bytes::{Buf, Bytes, BytesMut};

// frame = u32 big-endian length + payload
fn decode_get(buf: &mut BytesMut) -> Option<Bytes> {
  if buf.is_empty() {
    return None;
  }
  let len = buf.get_u32() as usize;
  if buf.len() < len {
    return None;
  }
  Some(buf.split_to(len).freeze())
}

fn decode_try_consuming(buf: &mut BytesMut) -> Option<Bytes> {
  let len = buf.try_get_u32().ok()? as usize; // header is consumed here
  if buf.len() < len {
    return None;
  }
  Some(buf.split_to(len).freeze())
}

fn decode_peek(buf: &mut BytesMut) -> Option<Bytes> {
  let len = (&buf[..]).try_get_u32().ok()? as usize; // reads a copy of the cursor
  if buf.len() < 4 + len {
    return None;
  }
  buf.advance(4);
  Some(buf.split_to(len).freeze())
}

fn run(name: &str, decode: fn(&mut BytesMut) -> Option<Bytes>, arrivals: &[usize]) {
  let wire: &[u8] = b"\x00\x00\x00\x05hello\x00\x00\x00\x03abc";
  println!("{name}");
  let r = panic::catch_unwind(|| {
    let mut buf = BytesMut::new();
    let mut at = 0;
    for &n in arrivals {
      buf.extend_from_slice(&wire[at..at + n]);
      at += n;
      while let Some(frame) = decode(&mut buf) {
        println!("    frame {frame:?}");
      }
      println!("    after {at:>2} bytes: buffered {buf:?}");
    }
  });
  if r.is_err() {
    println!("    (panicked)");
  }
}

fn main() {
  panic::set_hook(Box::new(|info| {
    let msg = info.payload().downcast_ref::<String>().cloned()
      .or_else(|| info.payload().downcast_ref::<&str>().map(|s| s.to_string()))
      .unwrap_or_default();
    let loc = info.location().unwrap();
    let file = loc.file().rsplit("bytes-1.12.1/").next().unwrap();
    println!("    panicked at {file}:{}: {msg}", loc.line());
  }));
  let split = [2, 5, 4, 5]; // how the bytes come off the socket
  run("get_u32", decode_get, &split);
  run("try_get_u32 on the buffer", decode_try_consuming, &split);
  run("try_get_u32 on the buffer, all at once", decode_try_consuming, &[16]);
  run("try_get_u32 on a peek", decode_peek, &split);
}

get_u32
    panicked at src/lib.rs:207: advance out of bounds: the len is 2 but advancing by 4
    (panicked)
try_get_u32 on the buffer
    after  2 bytes: buffered b"\0\0"
    after  7 bytes: buffered b"hel"
    after 11 bytes: buffered b"o\0\0"
    after 16 bytes: buffered b"\x03abc"
try_get_u32 on the buffer, all at once
    frame b"hello"
    frame b"abc"
    after 16 bytes: buffered b""
try_get_u32 on a peek
    after  2 bytes: buffered b"\0\0"
    after  7 bytes: buffered b"\0\0\0\x05hel"
    frame b"hello"
    after 11 bytes: buffered b"\0\0"
    frame b"abc"
    after 16 bytes: buffered b""