Skip to content

bug: corrupt IVF metadata aborts the process instead of being reported #9005

Description

@LuciferYang

TryFrom<PbIvf> for IvfModel has two ways to abort the process on a damaged index file instead of reporting it.

It asserts that the offsets and lengths vectors match in length (rust/lance-index/src/vector/ivf/storage.rs:235), and assert_eq! is compiled into release builds:

assertion `left == right` failed
  left: 2
 right: 3

The v1 centroid branch derives the centroid dimension by dividing the value count by the number of partition lengths (:209), which divides by zero when a file carries centroids and no lengths. Integer division by zero cannot be compiled out at all:

attempt to divide by zero

Both sit on the ordinary open path. IvfModel::try_from is what rust/lance/src/index/vector/ivf/v2.rs calls when opening a v3 IVF index, so any vector search over a damaged file takes it, and from Python it surfaces as a PanicException with no indication of which file was bad.

Nothing in Lance writes either shape: add_partition grows both vectors together and TryFrom<&IvfModel> for PbIvf copies both, so the trigger is a truncated, hand-edited, or foreign-written file rather than something a normal write can produce. That makes these read-side hardening items rather than bugs users hit through the API, but the failure mode is the wrong one for a parse boundary: rust/AGENTS.md maps format and integrity failures to Error::corrupt_file and reserves assert! for conditions that prevent data corruption.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions