Problem
decodeComponent's default section branch records any unrecognized section ID in RawSections and advances past it. ErrInvalidSectionID is defined but never used.
Relevant code: https://github.com/wago-org/component-model/blob/8a61139958e559a0ae61c3f49f6e9f33fddb6a95/internal/binary/decoder.go
For an execution engine, silently skipping an unknown or unsupported definition section is unsafe. Component sections contribute definitions to ordered index spaces and may carry required validation/instantiation semantics. Continuing as though the section were absent can shift every subsequent index or omit behavior while still returning a Component that the instantiator treats as decoded.
This also affects known-but-unimplemented format additions. For example, the current Component Model grammar includes a section-12 value definition behind a gated feature; a 0.2-only engine should reject it explicitly rather than skip it and attempt to instantiate the remaining component.
Impact
Malformed or unsupported components may pass decoding and reach compilation/instantiation with a structurally incomplete model. Depending on following aliases/canons/exports, this can produce misleading out-of-range failures, bind indices to the wrong definitions, or execute a component after silently discarding required semantics.
The engine claims compatibility with a pinned Component Model feature set, so fail-open forward compatibility is the wrong boundary here.
Suggested fix
- Return
ErrInvalidSectionID for IDs not present in the pinned format.
- For a known section whose feature is not implemented, return a distinct
unsupported component feature/section validation error.
- Do not put semantic definition sections into
RawSections; reserve raw skipping for custom section 0 only.
- Add an explicit feature/version table so future format additions cannot become implicitly accepted through the default branch.
Regression tests
- An arbitrary invalid ID such as
0xff must fail decode.
- A syntactically valid but unsupported known section must fail with an unsupported-feature error.
- A component placing aliases/exports after the skipped section must never reach instantiation.
- Custom sections must continue to be accepted and skipped with strict size bounds.
Problem
decodeComponent's default section branch records any unrecognized section ID inRawSectionsand advances past it.ErrInvalidSectionIDis defined but never used.Relevant code: https://github.com/wago-org/component-model/blob/8a61139958e559a0ae61c3f49f6e9f33fddb6a95/internal/binary/decoder.go
For an execution engine, silently skipping an unknown or unsupported definition section is unsafe. Component sections contribute definitions to ordered index spaces and may carry required validation/instantiation semantics. Continuing as though the section were absent can shift every subsequent index or omit behavior while still returning a
Componentthat the instantiator treats as decoded.This also affects known-but-unimplemented format additions. For example, the current Component Model grammar includes a section-12 value definition behind a gated feature; a 0.2-only engine should reject it explicitly rather than skip it and attempt to instantiate the remaining component.
Impact
Malformed or unsupported components may pass decoding and reach compilation/instantiation with a structurally incomplete model. Depending on following aliases/canons/exports, this can produce misleading out-of-range failures, bind indices to the wrong definitions, or execute a component after silently discarding required semantics.
The engine claims compatibility with a pinned Component Model feature set, so fail-open forward compatibility is the wrong boundary here.
Suggested fix
ErrInvalidSectionIDfor IDs not present in the pinned format.unsupported component feature/sectionvalidation error.RawSections; reserve raw skipping for custom section 0 only.Regression tests
0xffmust fail decode.