Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

WavDecoder::size_hint underflows (u32 wrap, ~4.29e9) after EOF, causes multi-GB Vec::collect() allocation

未关闭
  • 哪里不对？
#929 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

@marin-m 已经在做这个了。

开始于 2026年10月25日。

  • #933 来自 @marin-m —— 未关闭

评估

难度
3/5
预计耗时
1-2 天
新手友好度
72/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
rust
领域
audio-video-rtc

调研方向

Start in src/decoder/wav.rs, in SamplesIterator::next and its size_hint, where samples_read is incremented before the read and subtracted from the reader length using u32 arithmetic. Run the repro with a debug build to see the overflow panic, then check how SampleRateConverter reads past the end of its input. Done means size_hint never wraps after EOF, the increment only counts returned samples or stops at len, and the repro's collect() no longer requests gigabytes.

由索引模型根据 Issue 内容生成。

描述

Title: WavDecoder::size_hint underflows (u32 wrap, ~4.29e9) after EOF, causes multi-GB Vec::collect() allocation

Version: rodio 0.22.2 (also present on current master), features: hound

What happens
SamplesIterator::next (src/decoder/wav.rs) increments samples_read unconditionally before reading
the next sample, so it keeps counting when called at/after the end of the data. size_hint then does
self.reader.len() - self.samples_read on u32s. Once samples_read > len this wraps to ~2^32
(release) or panics with "attempt to subtract with overflow" (debug, wav.rs:141).

SampleRateConverter reads past the end of its input, so this is hit by the normal
UniformSourceIterator path. Iterator::collect() uses size_hint().0 to reserve capacity whenever
the Vec has to grow, so depending only on the sample count, collect() requests ~5.7 GB
(2^32 / 3 elements * 4 bytes after 48 kHz -> 16 kHz) and aborts:
memory allocation of 5727255148 bytes failed (exit 134) on systems that refuse the reservation.
In practice this showed up in an application as a crash on ~1 in 3 file lengths.

Repro (Cargo.toml: rodio = { version = "0.22.2", default-features = false, features = ["hound"] })

use rodio::{Decoder, Source, nz};
use std::io::Cursor;

fn wav(num_samples: u32) -> Vec<u8> {
    let data_len = num_samples * 2;
    let mut b = Vec::new();
    b.extend_from_slice(b"RIFF");
    b.extend_from_slice(&(36 + data_len).to_le_bytes());
    b.extend_from_slice(b"WAVEfmt ");
    b.extend_from_slice(&16u32.to_le_bytes());
    b.extend_from_slice(&1u16.to_le_bytes());      // PCM
    b.extend_from_slice(&1u16.to_le_bytes());      // mono
    b.extend_from_slice(&48000u32.to_le_bytes());
    b.extend_from_slice(&96000u32.to_le_bytes());
    b.extend_from_slice(&2u16.to_le_bytes());
    b.extend_from_slice(&16u16.to_le_bytes());
    b.extend_from_slice(b"data");
    b.extend_from_slice(&data_len.to_le_bytes());
    b.resize(b.len() + data_len as usize, 0);
    b
}

fn main() {
    // Minimal: one extra next() after the end
    let mut decoder = Decoder::new(Cursor::new(wav(10))).unwrap();
    while decoder.next().is_some() {}
    decoder.next();
    println!("{:?}", decoder.size_hint()); // release: (4294967294, Some(4294967294)); debug: panic

    // Via the resampler: collect() asks for ~5.7 GB when len happens to trigger a reallocation
    let decoder = Decoder::new(Cursor::new(wav(474_067))).unwrap();
    let v: Vec<f32> = rodio::source::UniformSourceIterator::new(decoder, nz!(1), nz!(16000)).collect();
    println!("{}", v.len());
}

Suggested fix: in next(), only increment samples_read when a sample was actually returned
(or at least don't count past len), and use saturating_sub in size_hint.

Workaround for callers: don't use collect()/extend() on rodio sources; push into a Vec in a loop.

主要语言
Rust
星标
2.5k
派生
338
平均合并
1 天 3 小时
30 天内合并 PR
1

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

RustAudio/rodio 的其他 Issue

查看 RustAudio/rodio 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。