fix: harden latent libeot-parity gaps (v1.5.1) - #6
Merged
Conversation
Follow-up to the v1.5.0 review — the low-severity items that were latent or dead-code but worth closing: - mtx-decompress: the uncompressed passthrough returned the caller's own buffer while a comment claimed it copied. libeot (writeFontFile.c) always copies; return an owned copy so mutating the result never writes back into the caller's array. - lzcomp: add the ERR_LZCOMP_Decode_bounds equivalent — a final copy item can drive `pos` past `outLen`, and libeot errors here rather than returning the trailing garbage. Throws EotError(MtxError) on overrun. - stream: checksumU32 now bounds on endPos (not size), so an unaligned range no longer folds in bytes past endPos, and it validates the span; readNBits rejects widths > 32 and returns unsigned; writeU24 rejects out-of-range values instead of silently truncating. - bitio: readValue returns unsigned (a 32-bit read with the top bit set was surfacing as negative). - ahuff: bitsUsed(0) returns 1 to match libeot's BitsUsed (defensive; never reached in practice). All exercised by new unit tests; 214 passing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to the #5 review — closes the low-severity items that were latent or dead-code but still worth fixing for parity with libeot.
Fixes
decompressMtxaliased the caller's buffer. The uncompressed passthrough returned the caller's own array while a comment claimed it copied. libeot (writeFontFile.c) always copies — now so do we, so mutating the result can't write back into the caller's input.pospastoutLen; libeot raisesERR_LZCOMP_Decode_boundshere rather than returning the trailing garbage the overshoot produced. Now throwsEotError(MtxError).Stream.checksumU32bounded onsize, notendPos. An unaligned span folded in bytes pastendPos, yielding a different checksum than libeot. Now bounds strictly onendPosand validates the span. (Dead code today — inlined elsewhere — but exported and unit-tested.)Stream.readNBits/writeU24range checks.readNBitsnow rejects widths > 32 and returns unsigned (a 32-bit read with the top bit set was surfacing as negative);writeU24rejects out-of-range values instead of silently truncating.BitIO.readValuereturns unsigned. Same signed-shift issue for a full 32-bit read.ahuff.bitsUsed(0)returns 1 to match libeot'sBitsUsed(defensive; never reached in practice — range is always 8 or ≥267).None of these changed a valid-input decode path; they harden corrupt-input handling and exported-utility correctness.
Deferred (tracked separately)
The genuinely cosmetic / by-design remainder is captured in an issue rather than changed here: mid-byte boundary enforcement, the malformed-input bbox int16 wrap, grow-vs-error on
*ThroughReserve, and the silent hdmx/VDMX skip.Verification
bun run typecheck,bun run build— passbun run test— 214 passing (up from 209; +5 regression tests)Patch release 1.5.1.
🤖 Generated with Claude Code