From 04cea295b5d22da8f631a6489790fdfb55e85bf3 Mon Sep 17 00:00:00 2001
From: TapTap <taptap.programming@gmail.com>
Date: Fri, 4 Sep 2026 02:25:26 +0200
Subject: [PATCH] fix: enforce max alloc in delta deserialization

---
 src/shared/delta.c      |  2 +-
 tests/test_robustness.c | 15 +++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/shared/delta.c b/src/shared/delta.c
index 5e277fd..776ef90 100644
--- a/src/shared/delta.c
+++ b/src/shared/delta.c
@@ -396,7 +396,7 @@ Delta* delta_deserialize(const Data* data) {
   const uint8_t* buf = (const uint8_t*)data->data;
   size_t pos = 0;
 
-  Delta* delta = malloc(sizeof(Delta));
+  Delta* delta = protocol_alloc(sizeof(Delta));
   if (!delta)
     return NULL;
 
diff --git a/tests/test_robustness.c b/tests/test_robustness.c
index a03f163..1e1cd09 100644
--- a/tests/test_robustness.c
+++ b/tests/test_robustness.c
@@ -109,6 +109,20 @@ static void test_delta_deserialize_garbage() {
   data_destroy(d);
 }
 
+static void test_delta_deserialize_respects_max_alloc() {
+  unsigned char serialized[sizeof(uint64_t) + sizeof(uint32_t)] = {0};
+  Data data = {.data = serialized, .size = sizeof(serialized)};
+  ProtocolSession session;
+  protocol_session_init(&session, -1, -1);
+  protocol_session_set_max_alloc(&session, sizeof(Delta) - 1);
+  protocol_session_bind(&session);
+
+  const Delta* result = delta_deserialize(&data);
+  EXPECT_NULL(result);
+
+  protocol_session_unbind();
+}
+
 static void test_delta_signature_deserialize_truncated() {
   char old_data[4096];
   for (int i = 0; i < 4096; i++)
@@ -206,6 +220,7 @@ void test_robustness() {
   test_delta_deserialize_truncated();
   test_delta_deserialize_empty();
   test_delta_deserialize_garbage();
+  test_delta_deserialize_respects_max_alloc();
   test_delta_deserialize_truncated_instructions();
   test_delta_signature_deserialize_truncated();
   test_delta_apply_null();