[FIX] Sync Rust inputfile array length with num_input_files to fix heap OOB read#2218
Open
NexionisJake wants to merge 1 commit intoCCExtractor:masterfrom
Open
[FIX] Sync Rust inputfile array length with num_input_files to fix heap OOB read#2218NexionisJake wants to merge 1 commit intoCCExtractor:masterfrom
NexionisJake wants to merge 1 commit intoCCExtractor:masterfrom
Conversation
… num_input_files The Rust FFI function copy_from_rust() computed num_input_files by filtering empty strings from the inputfiles Vec, but passed an unfiltered clone to string_to_c_chars() to build the C inputfile[] array. This mismatch made the C array length and num_input_files disagree: switch_to_next_file() could index inputfile[current_file] where current_file < num_input_files but >= array size, reading one slot past the end of the allocated array — confirmed by AddressSanitizer (heap-buffer-overflow at file_functions.c:183). The same count/size mismatch also caused free_rust_c_string_array() to reconstruct the Vec with an incorrect capacity, producing heap corruption on every clean shutdown. Fix: filter empty strings into a single Vec<String> first, then derive both num_input_files (filtered.len()) and the C array (string_to_c_chars(filtered)) from that same source, eliminating the mismatch entirely. Fixes CCExtractor#2182 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Collaborator
CCExtractor CI platform finished running the test files on linux. Below is a summary of the test results, when compared to test for commit 03ad9e8...:
Your PR breaks these cases:
NOTE: The following tests have been failing on the master branch as well as the PR:
Congratulations: Merging this PR would fix the following tests:
It seems that not all tests were passed completely. This is an indication that the output of some files is not as expected (but might be according to you). Check the result page for more info. |
Collaborator
CCExtractor CI platform finished running the test files on windows. Below is a summary of the test results, when compared to test for commit 03ad9e8...:
Your PR breaks these cases:
NOTE: The following tests have been failing on the master branch as well as the PR:
Congratulations: Merging this PR would fix the following tests:
It seems that not all tests were passed completely. This is an indication that the output of some files is not as expected (but might be according to you). Check the result page for more info. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In
copy_from_rust()(src/rust/src/common.rs),num_input_fileswascomputed by filtering empty strings from the inputfiles Vec, but
string_to_c_chars()was called on an unfiltered clone of the same Vec.This mismatch made the C array length and
num_input_filesdisagree:switch_to_next_file()could indexinputfile[current_file]wherecurrent_file < num_input_filesbut>= array size, reading one slot pastthe end of the allocated array — confirmed by AddressSanitizer
(heap-buffer-overflow at file_functions.c:183).
The same count/size mismatch also caused
free_rust_c_string_array()toreconstruct the Vec with an incorrect capacity, producing heap corruption on
every clean shutdown.
Fix: filter empty strings into a single
Vec<String>first, then derive bothnum_input_files(filtered.len()) and the C array(
string_to_c_chars(filtered)) from that same source, eliminating themismatch entirely.
Fixes #2182
In raising this pull request, I confirm the following (please check boxes):
Reason for this PR:
exists.
Sanity check:
guide.
the changelog.
Repro instructions:
Build CCExtractor with AddressSanitizer enabled: