Add depth guard to deserialize_value_typed

youknowone · youknowone · commit 76856b431fa8 · 2026-03-22T21:58:05.000+09:00
Prevents usize underflow when dict key deserialization path calls
deserialize_value_typed with depth=0 on composite types.
diff --git a/crates/compiler-core/src/marshal.rs b/crates/compiler-core/src/marshal.rs
@@ -524,6 +524,9 @@ fn deserialize_value_typed<R: Read, Bag: MarshalBag>(
     refs: &mut Vec<Option<Bag::Value>>,
     typ: Type,
 ) -> Result<Bag::Value> {
+    if depth == 0 {
+        return Err(MarshalError::InvalidBytecode);
+    }
     let value = match typ {
         Type::True => bag.make_bool(true),
         Type::False => bag.make_bool(false),
