Repository navigation
Reject nonnumeric list elements in strict text and codec conversion - #1616
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
The account paying for this security review has reached its Codex usage limits. The payer can check the Codex usage dashboard. For personal accounts, using credits requires enabling “Use credits for security reviews” in Code review settings. If you do not manage the paying account, contact this repository's admins. |
86d0b94 to
96bbbb5
Compare
Validate consumed elements at the shared conversion boundary while retaining numeric NUL termination and EIGS_STRICT=0 numeric-zero compatibility. Original runtime: 9/12 focused checks, three strict text regressions red. Candidate enrolled section: release 12/12; ASan/UBSan with leaks 12/12; zlib 23/23. Independent exact-output controls: 24/24. Suite labels 289; changelog one fragment; independent review found no remaining scoped defect. Full CI and downstream acceptance remain merge requirements. Refs #1590, #1416.
The new strict byte-element validator changes the helper closure of five unary-data APIs. They still accept a whole byte list rather than a bounded argument tuple; independently review that contract and include the validator in each fingerprint closure. No runtime or test behavior changes here. Original metadata: five source/helper mismatches, GCC suite4256/4258. Updated source audit:204candidates,147guarded,57exempt,0errors. Contract selftest:20/20. Full strict differential exit0:147declared, 138passed,9unavailable,0failed;35guarded gfx names/140rows, 131raised/9allowlisted,0silent;37pixel rows,23strict rejections. No-baseline mode did not measure generic baseline equality. Independent metadata review recomputed all body/helper hashes and confirmed no exemption broadened. Refs #1590.
96bbbb5 to
7a26443
Compare
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
The account paying for this security review has reached its Codex usage limits. The payer can check the Codex usage dashboard. For personal accounts, using credits requires enabling “Use credits for security reviews” in Code review settings. If you do not manage the paying account, contact this repository's admins. |
2 participants
str_from_bytestreated a nonnumeric list element as NUL, so[65, "x", 66]silently returnedAeven in strict mode. Text and enabled DEFLATE codecs now share strict element validation. Compatibility mode keeps numeric-zero substitution; text still stops at a numeric NUL, while codecs consume the full list. The enrolled tests and four front-door documents cover that distinction.At head
96bbbb543fdbfe01e809eee09e7c67986085ed1d, release and leak-enabled ASan/UBSan targeted suites each pass 26/26; enabled-codec checks pass 23/23. Shape classification reports 204 candidates/147 guarded/57 exempt/0 errors, its selftests pass 20/20, and docs/291 suite labels pass. Original-source controls demonstrated the strict conversion failures. Fresh-head hosted checks and all 13 external CodSpeed benchmarks are green. Full merge-queue checks remain required.Complete 16-consumer acceptance: ACCEPTED. The full wave ran once at tested HEAD
44abc6d5(treec9bbb380): 16/16 PASS, zero consumer skips, every tool/launcher/driver/harness exit 0, elapsed 3,890.8 s; an independent critic compared the complete pre/post manifests (all 17 source HEADs, path/content/mode identities, owning binaries) and found no blocker. The earlier failed and incomplete runs stay recorded as history.Ancestry transfer, proven by tree identity.
44abc6d5sat onf83c5235, the pre-squash form of #1629. Main's #1629 squash45a71e1dhas the same parent (f652f0d8) and the same tree (60b50fa4) asf83c5235. Cherry-picking this PR's two commits onto45a71e1dyields head7a26443dwith treec9bbb380, byte-identical to the tested tree, so the acceptance evidence applies to this exact head without relabelling. Consumer pin changes and release publication remain separate work.The broader conversion audit retains its separate residual contracts.
Closes #1590.