dangernoodle-io / breadboard / 29552862295 / 1

96%

main: 96%

push

github

fix: guard bb_serialize_populate array field against frame-stack overflow at max depth (#905)

- populate_fields() now checks depth >= BB_SERIALIZE_MAX_DEPTH before
  calling src->begin_arr() for a BB_TYPE_ARR field, mirroring the existing
  BB_TYPE_OBJ guard's before-the-call placement -- previously begin_arr()
  was called unconditionally, so a descriptor nested to exactly
  BB_SERIALIZE_MAX_DEPTH via BB_TYPE_OBJ fields with an array at the
  deepest level drove a populate source's frame depth one past its
  capacity before any guard could catch it.
- populate_check_fields() (the pre-flight validator) no longer blindly
  passes once depth >= BB_SERIALIZE_MAX_DEPTH; it now inspects fields at
  that depth and rejects an OBJ/ARR field there with BB_ERR_NO_SPACE (a
  scalar field is harmless and still passes) -- so a too-deep descriptor
  fails before any scatter begins, not mid-scatter.
- Since pre-flight is now a sound structural predictor of every depth
  populate_fields() could reach, the (still correct) runtime depth guards
  and their error-propagation path are unreachable via the public
  bb_serialize_populate() entry point; marked LCOV_EXCL_LINE, matching the
  existing pre-flight-rejected/defensive convention already used for
  STR_N/REF in this file.
- Adds a canary-guarded regression test proving begin_arr() is never
  called at the overflowing depth, plus a MAX_DEPTH-1 test proving the
  guard doesn't over-clamp.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

7040 of 7677 branches covered (91.7%)

Branch coverage included in aggregate %.

11973 of 12196 relevant lines covered (98.17%)

2405.04 hits per line