fix(score): size chunk ptr buffers to PATH_MAX instead of 512 bytes#655
Merged
Conversation
resolve_ptrs() iterates self.indices.len() times over a fixed-size
[*const u8; 32] buffer with no guard. When a file path exceeds 512
bytes (32 chunks × 16 bytes), the loop accesses buf[32] and panics:
index out of bounds: the len is 32 but the index is 32
On macOS PATH_MAX is 1024, so any legitimately long path can trigger
this. Clamp count to buf.len() so pathological paths are truncated
gracefully instead of crashing.
Fixes an OOB panic found in pi-fff v0.9.6.
The scoring hot path passed fixed [*const u8; 32] buffers (32 * 16 = 512 bytes) to resolve_ptrs while PATH_BUF_SIZE allows PATH_MAX-long paths (1024 on macOS, 4096 on Linux), so any path over 512 bytes panicked with an out of bounds index. neo_frizbee 0.10.4 makes the resolver buffer size a const generic, so the buffers are now sized MAX_PATH_CHUNKS = PATH_BUF_SIZE / 16 at compile time and long paths are matched in full instead of truncated. Also covers the frizbee greedy fallback for haystacks longer than its DP matrix which previously scanned a stale score matrix and panicked. Adds regression tests for both the resolve_ptrs unit level and the full scoring pipeline.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proper fix for the OOB panic reported in #652.
The scoring hot path passed fixed
[*const u8; 32]buffers (512 bytes) toresolve_ptrswhilePATH_BUF_SIZEallows PATH_MAX-long paths (1024 on macOS, 4096 on Linux), so any path over 512 bytes panicked with an OOB index