dangernoodle-io / breadboard / 29963890129

96%

push

github

test: pin populate_get_str NUL-termination contract (#1005)

- populate_get_str() (bb_serialize_json_populate.c) never NUL-terminates
  its destination: it memcpy's min(value_len, max_len) bytes and relies
  entirely on the destination's own caller-zeroed slack byte for
  termination
- the correct BB_TYPE_STR max_len is therefore direction/consumer
  dependent, not a single universal value -- an ingress field read via an
  unbounded C-string function (strcmp/strlen) needs max_len ==
  sizeof(dest) - 1 so a memset0-seeded destination stays terminated after
  the widest possible input, while an egress field (bb_serialize_walk) or
  an ingress field consumed only via a strnlen()-bounded read may
  correctly use the full sizeof(dest), since strnlen(p, max_len) never
  runs past its own bound regardless of termination
- adds two host tests against a confirm[32]-shaped destination pinning
  distinct paths: n = len (input under max_len, no truncation) and n =
  cap (input at/over max_len, truncated) -- both additionally assert
  every byte strictly after the written prefix is left completely
  untouched (via a non-zero sentinel fill, not the caller-zeroed
  production contract), positively distinguishing "never touches beyond
  n" from a hypothetical alternate mechanism that writes its own
  terminator at dst[n]
- the over-cap test's own distinct value is narrower than the under-cap
  case: it's the only test proving no write lands on the same-buffer
  slack byte under truncation for this ingress shape (max_len ==
  sizeof(dst) - 1), distinct from the pre-existing egress-style
  over-cap-truncates test, whose zero-slack buffer can only prove no
  overrun into an adjacent field's canary

7386 of 7976 branches covered (92.6%)

Branch coverage included in aggregate %.

12530 of 12692 relevant lines covered (98.72%)

2500.14 hits per line