Skip to content

fix: reject in-width FAST varint overflow; fix signed size thresholds - #28

Merged
ruoka merged 1 commit into
masterfrom
cursor/critical-bug-management-4230
Jul 28, 2026
Merged

fix: reject in-width FAST varint overflow; fix signed size thresholds#28
ruoka merged 1 commit into
masterfrom
cursor/critical-bug-management-4230

Conversation

@cursor

@cursor cursor Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Reject FAST varint decodes whose N×7 payload bits overflow the destination (completes fix: reject overlong FAST varints that silently truncate #27’s byte-count caps): e.g. uint64 [0x02, eight 0x00, 0x80] no longer becomes 0, and int64 [0x01, eight 0x00, 0x80] no longer wraps to INT64_MIN.
  • Fix signed size() thresholds that used positive hex literals (0x00000000ffffffc0ll etc.), so small negatives encode in the canonical 1–4 bytes (e.g. -1ff) instead of always using ≥5 bytes.

Test plan

  • ./tools/CB.sh … debug test --tags=[xson] — 427/427 passed
  • New regression cases for in-width overflow and canonical negative sizes
Open in Web View Automation 

Byte-count caps from #27 still allowed N×7 payload bits into narrower
registers, so forms like uint64 [0x02, eight 0x00, 0x80] decoded as 0.
Reject shifts that would drop high bits. Also fix signed size() literals
that were positive (0x00000000ffffffc0ll etc.), so small negatives encoded
as 5+ bytes instead of the canonical 1–4 byte forms.

Co-authored-by: Kaius  Ruokonen <ruoka@users.noreply.github.com>
@ruoka
ruoka marked this pull request as ready for review July 28, 2026 06:41
@ruoka
ruoka merged commit a77eaa0 into master Jul 28, 2026
4 checks passed
@ruoka
ruoka deleted the cursor/critical-bug-management-4230 branch July 28, 2026 06:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants