Summary
EventMonitor 0.5.0 renders Structured payloads by reparsing the Event Transport payload through Serializable::BinaryArchive, constructing a second heap-backed SerializationNode tree solely for diagnostics. On ESP32, a valid Event payload can therefore crash the application under low-memory conditions even though the Event itself has already deserialized successfully.
Malformed/adversarial payloads also need to be rejected under strict monitor-specific limits rather than becoming an unbounded diagnostic workload.
Reproduction context
EventConsole-Lab reproduced an ESP32 LoadProhibited panic while EventMonitor printed an inbound Event transport transaction. Output ended immediately after payload:. Exact ELF/map decoding identified:
EventMonitor::OnEventTransportTransaction -> EventMonitorFormatter::PrintStructuredPayload -> BinaryArchive::Load -> BinaryArchive::DecodeNode -> SerializationNode::Set -> std::vector reallocation -> operator new -> __cxa_throw / pthread_getspecific -> LoadProhibited.
The transaction stage was InboundDeserialized, so the reproduced payload was already accepted and deserialized by Event; malformed wire bytes are not required to trigger the defect.
Expected behaviour
Diagnostic structured rendering must not construct a duplicate heap-backed payload tree merely to print it. It should traverse ESPB bytes directly under strict limits and fail closed to bounded fallback output when a payload is invalid or outside the configured diagnostic limits.
Required coverage
- allocation-free structured payload traversal/rendering;
- malformed/truncated payload rejection;
- nesting, aggregate-node, collection, and string limits;
- deterministic random/adversarial validation stress coverage;
- safe bounded fallback output;
- compatibility with valid existing structured output;
- ESP32 compile/integration validation.
Dependency
This fix consumes the bounded/allocation-free ESPB traversal introduced for Flowduino/ESPressio-Serializable#2 and targets ESPressio Serializable 0.10.1.
Event audit
ESPressio Event's transaction payload ownership was audited as part of this defect. The transaction payload is borrowed, but its backing buffer remains alive for the full synchronous observer notification on both inbound and outbound paths. No Event ownership/lifetime defect was identified from this reproduction.
Summary
EventMonitor0.5.0 rendersStructuredpayloads by reparsing the Event Transport payload throughSerializable::BinaryArchive, constructing a second heap-backedSerializationNodetree solely for diagnostics. On ESP32, a valid Event payload can therefore crash the application under low-memory conditions even though the Event itself has already deserialized successfully.Malformed/adversarial payloads also need to be rejected under strict monitor-specific limits rather than becoming an unbounded diagnostic workload.
Reproduction context
EventConsole-Lab reproduced an ESP32
LoadProhibitedpanic while EventMonitor printed an inbound Event transport transaction. Output ended immediately afterpayload:. Exact ELF/map decoding identified:EventMonitor::OnEventTransportTransaction -> EventMonitorFormatter::PrintStructuredPayload -> BinaryArchive::Load -> BinaryArchive::DecodeNode -> SerializationNode::Set -> std::vector reallocation -> operator new -> __cxa_throw / pthread_getspecific -> LoadProhibited.The transaction stage was
InboundDeserialized, so the reproduced payload was already accepted and deserialized by Event; malformed wire bytes are not required to trigger the defect.Expected behaviour
Diagnostic structured rendering must not construct a duplicate heap-backed payload tree merely to print it. It should traverse ESPB bytes directly under strict limits and fail closed to bounded fallback output when a payload is invalid or outside the configured diagnostic limits.
Required coverage
Dependency
This fix consumes the bounded/allocation-free ESPB traversal introduced for Flowduino/ESPressio-Serializable#2 and targets ESPressio Serializable 0.10.1.
Event audit
ESPressio Event's transaction payload ownership was audited as part of this defect. The transaction payload is borrowed, but its backing buffer remains alive for the full synchronous observer notification on both inbound and outbound paths. No Event ownership/lifetime defect was identified from this reproduction.