fix(moq-net): bound frame size in create_frame/append_frame (#1882)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: kixelated

rs/moq-net/src/model/frame.rs

@@ -17,9 +17,11 @@ use crate::{Error, Result};
 /// a group. 16 MiB was too tight for a high-bitrate CMAF fragment carried as one
 /// frame; 32 MiB covers that while keeping the per-frame preallocation bounded.
 ///
-// TODO enforce this in [Frame::produce] / [FrameProducer::new] so the limit is
-// guaranteed for every caller, not just the wire decode paths. Blocked on
-// making the constructor fallible (returning [Result]), which is an API break.
+/// Enforced on the wire decode (above) and in
+/// [`GroupProducer::create_frame`](super::group::GroupProducer::create_frame), which rejects an
+/// oversized frame *before* `produce()` allocates its buffer. A direct `FrameProducer::new` still
+/// allocates ahead of the [`append_frame`](super::group::GroupProducer::append_frame) backstop;
+/// closing that gap means a fallible constructor, which is a breaking change left to a separate `dev` PR.
 pub(crate) const MAX_FRAME_SIZE: u64 = 32 * 1024 * 1024;
 
 /// A chunk of data with an upfront size.

rs/moq-net/src/model/group.rs

@@ -12,7 +12,7 @@ use std::task::{Poll, ready};
 
 use bytes::Bytes;
 
-use crate::{Error, Result};
+use crate::{Error, MAX_FRAME_SIZE, Result};
 
 use super::{Frame, FrameConsumer, FrameProducer};
 
@@ -179,13 +179,23 @@ impl GroupProducer {
 
 	/// Create a frame with an upfront size
 	pub fn create_frame(&mut self, info: Frame) -> Result<FrameProducer> {
+		// Reject before `produce()`: `FrameProducer::new` preallocates `size` bytes, so an oversized
+		// frame must be caught here or it triggers the very allocation the limit exists to prevent.
+		if info.size > MAX_FRAME_SIZE {
+			return Err(Error::FrameTooLarge);
+		}
 		let frame = info.produce();
 		self.append_frame(frame.clone())?;
 		Ok(frame)
 	}
 
 	/// Append a frame producer to the group.
 	pub fn append_frame(&mut self, frame: FrameProducer) -> Result<()> {
+		// Backstop for direct callers (the buffer is already allocated by the time we hold a
+		// FrameProducer); `create_frame` is the path that rejects before allocating.
+		if frame.size > MAX_FRAME_SIZE {
+			return Err(Error::FrameTooLarge);
+		}
 		let mut state = modify(&self.state)?;
 		if state.fin {
 			return Err(Error::Closed);
@@ -441,6 +451,20 @@ mod test {
 		assert_eq!(chunks[0], Bytes::from_static(b"helloworld"));
 	}
 
+	#[test]
+	fn append_rejects_oversized_frame() {
+		let mut producer = Group { sequence: 0 }.produce();
+		let err = producer.create_frame(Frame {
+			size: MAX_FRAME_SIZE + 1,
+		});
+		assert!(
+			matches!(err, Err(Error::FrameTooLarge)),
+			"a frame over the limit is rejected"
+		);
+		// A frame at the limit is still accepted.
+		assert!(producer.create_frame(Frame { size: MAX_FRAME_SIZE }).is_ok());
+	}
+
 	#[test]
 	fn get_frame_by_index() {
 		let mut producer = Group { sequence: 0 }.produce();