orion-ecs / keen-eye / 30015461745 / 1

64%

main: 64%

push

github

fix(core): Harden binary snapshot deserialization against crafted saves

Addresses findings 1, 2, 10, 11, and 12 from nightly review issue #1082:

- SnapshotManager: guard Math.Abs(int.MinValue) OverflowException on
  component/singleton data lengths by widening to long, so corrupt or
  crafted saves throw InvalidDataException per the method contract.
- SnapshotManager: bound entityCount/singletonCount from binary headers
  (new MaxEntityCount = 1_000_000) before using them as list capacities,
  preventing memory-exhaustion DoS from crafted headers.
- EntityNamingManager: merge ValidateName+RegisterName into a single
  atomic locked RegisterName, removing the TOCTOU window, and document
  precisely what thread-safety is guaranteed. World.CreateEntity now
  releases the pooled entity if name registration fails.
- Commands: extract shared PlaceholderResolvingCommand base class,
  removing 4x duplicated targetEntity/placeholderId/ResolveEntity
  boilerplate from Add/Set/RemoveComponent and Despawn commands.
- SimdHelpersTests: replace Assert.True(true) tautology with a real
  assertion (property is gate-free and consistent across reads).

Refs #1082

8378 of 12498 branches covered (67.03%)

Branch coverage included in aggregate %.

50333 of 79447 relevant lines covered (63.35%)

0.97 hits per line