Skip to content

Fix buffer over-read in getUTF8Char - #38

Merged
ChrisJefferson merged 1 commit into
masterfrom
fix-utf8-overrun
Aug 18, 2026
Merged

Fix buffer over-read in getUTF8Char#38
ChrisJefferson merged 1 commit into
masterfrom
fix-utf8-overrun

Conversation

@fingolfin

Copy link
Copy Markdown
Member

getChar indexed the string without checking the bound, so a truncated
multi-byte sequence at the very end of a string made getUTF8Char read past
it while looking for continuation bytes. In practice ELM_LIST raised
"List Element: [n] must have an assigned value", so
GapToJsonString([ CHAR_INT(200) ]) failed outright.

Pass the length down and return 0 past the end. Since 0 is not a
continuation byte, the sequence takes the existing "hope this is Latin-1"
path, which is what a malformed sequence anywhere else in the string
already does.

The local variable holding the number of bytes in the sequence is renamed
to nbytes, as len now names the length of the string.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

getChar indexed the string without checking the bound, so a truncated
multi-byte sequence at the very end of a string made getUTF8Char read past
it while looking for continuation bytes. In practice ELM_LIST raised
"List Element: <list>[n] must have an assigned value", so
GapToJsonString([ CHAR_INT(200) ]) failed outright.

Pass the length down and return 0 past the end. Since 0 is not a
continuation byte, the sequence takes the existing "hope this is Latin-1"
path, which is what a malformed sequence anywhere else in the string
already does.

The local variable holding the number of bytes in the sequence is renamed
to nbytes, as len now names the length of the string.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@codecov

codecov Bot commented Aug 17, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.42%. Comparing base (46eb033) to head (c5ffed9).

Additional details and impacted files
@@           Coverage Diff           @@
##           master      #38   +/-   ##
=======================================
  Coverage   96.42%   96.42%           
=======================================
  Files           6        6           
  Lines         140      140           
=======================================
  Hits          135      135           
  Misses          5        5           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ChrisJefferson
ChrisJefferson merged commit 68c1ba7 into master Aug 18, 2026
6 checks passed
@ChrisJefferson
ChrisJefferson deleted the fix-utf8-overrun branch August 18, 2026 10:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants