[atharvalade]

Which issue does this PR close?

Closes #3130

Rationale

DeserializeStreams and DeserializeToStream had zero bounds checking and no error propagation, causing silent data corruption for stream lists larger than 64KB.

What changed?

DeserializeToStream performed raw slice accesses without validating that the payload contained enough bytes for the 33-byte fixed header or the variable-length name. With large payloads (>64KB), any framing misalignment caused position drift—subsequent streams were deserialized from wrong offsets, silently returning corrupted data with no error.

The fix adds bounds validation before every access in DeserializeToStream (returns error on insufficient data), propagates errors through DeserializeStreams, and updates the TCP caller. A new test file covers single-stream, multi-stream, truncated header/name, corrupted payload, max-length name, and a 70KB+ regression test that verifies every field of ~1000 streams.

Local Execution

• Passed
• Pre-commit hooks ran

AI Usage

1. Opus 4.6
2. Minimal AI used
3. All tests ran locally and pass; verified against the Rust wire format
4. Yes, all code can be explained

[codecov]

Codecov Report

❌ Patch coverage is 90.90909% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 73.78%. Comparing base (ca2b10a) to head (8719da0).

Files with missing lines	Patch %	Lines
...nary_serialization/binary_response_deserializer.go	90.47%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #3165      +/-   ##
============================================
- Coverage     73.78%   73.78%   -0.01%     
  Complexity      943      943              
============================================
  Files          1200     1200              
  Lines        109094   109106      +12     
  Branches      85996    85994       -2     
============================================
+ Hits          80499    80502       +3     
- Misses        25859    25867       +8     
- Partials       2736     2737       +1     

Components	Coverage Δ
Rust Core	74.91% <ø> (ø)
Java SDK	58.44% <ø> (ø)
C# SDK	69.47% <ø> (+0.01%)	⬆️
Python SDK	81.43% <ø> (ø)
Node SDK	91.44% <ø> (-0.10%)	⬇️
Go SDK	39.91% <90.90%> (+0.10%)	⬆️

Files with missing lines	Coverage Δ
foreign/go/client/tcp/tcp_stream_management.go	82.85% <100.00%> (ø)
...nary_serialization/binary_response_deserializer.go	85.95% <90.47%> (-0.08%)	⬇️

... and 3 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs.

If you need a review, please ensure CI is green and the PR is rebased on the latest master. Don't hesitate to ping the maintainers - either @core on Discord or by mentioning them directly here on the PR.

Thank you for your contribution!

[hubcio]

/ready

[slbotbm]

one comment, otherwise lgtm

[hubcio]

@slbotbm use /author after you are done with review :)

/author

[atharvalade]

/ready

[slbotbm]

lgtm