fix: validate Bloom bit counts during deserialization

[tisonkun]

Summary

Validate the serialized Bloom num_bits_set cache against the decoded bit array.

For every non-empty image, deserialization now computes the population count. The dirty sentinel (u64::MAX) continues to request a recount, while any other mismatched cached count returns ErrorKind::InvalidData.

This prevents inconsistent metadata from making a non-empty bit array appear empty and causing contains to return a false negative.

Closes #187.

Regression coverage

The new tests verify that:

• a cached count of zero over a non-empty bit array is rejected,
• non-zero undercounts and overcounts are rejected,
• the dirty sentinel is accepted and recomputed, and
• inserted values remain present after the dirty-image decode.

The existing Java, C++, and Go snapshot suites pass unchanged.

Relationship to other implementations

Current Java, C++, and Go readers, like the previous Rust implementation, trust non-dirty cached counts and only recount the dirty sentinel:

• Java heap reader: https://github.com/apache/datasketches-java/blob/4067ffefabbcd03944dc3617ff2948ab760f3b75/src/main/java/org/apache/datasketches/filters/bloomfilter/HeapBitArray.java#L57-L83
• Java direct reader: https://github.com/apache/datasketches-java/blob/4067ffefabbcd03944dc3617ff2948ab760f3b75/src/main/java/org/apache/datasketches/filters/bloomfilter/DirectBitArrayR.java#L43-L54
• C++ reader: https://github.com/apache/datasketches-cpp/blob/c22888581964fc490feee835766cc8c3adb722e0/filters/include/bloom_filter_impl.hpp#L286-L314
• Go reader: https://github.com/apache/datasketches-go/blob/c558cc2d64f9a307c196a7adb0067eadd1b776f7/filters/bloom_filter_builder.go#L245-L269

This PR intentionally makes Rust stricter. It does not change the wire format and accepts every internally consistent image, including the shared dirty-sentinel representation. It only rejects corrupted metadata that can violate the Bloom no-false-negative contract.

Validation

• cargo x prepare-testdata
• cargo x check
• cargo x test
• cargo x lint

[Copilot]

Pull request overview

This PR hardens BloomFilter deserialization by validating the serialized num_bits_set cache against the decoded bit array’s actual population count, preventing corrupted metadata from causing false negatives in contains.

Changes:

• Compute the bit-array popcount during Bloom deserialization and require raw_num_bits_set to match it for non-dirty images.
• Continue accepting the dirty sentinel (u64::MAX) and recompute num_bits_set from the decoded bit array.
• Add regression tests covering undercount/overcount/zero-count corruption and dirty-sentinel recomputation behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
datasketches/src/bloom/sketch.rs	Validates num_bits_set against the computed popcount during deserialization; recomputes when the dirty sentinel is present.
datasketches/tests/serde_tests/bloom.rs	Adds regression tests ensuring inconsistent cached counts are rejected and dirty counts are recomputed while preserving membership.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[tisonkun]

Current Java, C++, and Go readers, like the previous Rust implementation, trust non-dirty cached counts and only recount the dirty sentinel:

cc @leerho @proost I'd appreicate it if you can check if it's an issue for Java/C++/Go impls also.

[proost]

In go, no issues for following this. And I also agree that more strict validation makes sense in here.

[tisonkun]

In go, no issues for following this. And I also agree that more strict validation makes sense in here.

Thanks for your feedback!