Skip to content

fix(xmlreader): bound reads for truncated BOM prefixes - #2667

Merged
thorstendb-ARM merged 2 commits into
mainfrom
fix/xmlreader-bom-bounds
Oct 23, 2026
Merged

thorstendb-ARM merged 2 commits into
mainfrom
fix/xmlreader-bom-bounds

Conversation

@thorstendb-ARM

Copy link
Copy Markdown
Contributor

Changes

XML_Reader::CheckUTF() could read beyond the string terminator for truncated BOM
prefixes (EF, FE, FF, EF BB) and report retained bytes as M412.
Bound byte consumption to the input length, preserving the switch structure and
existing diagnostics for complete inputs.

Validation

On macOS arm64 Debug, the new regression failed on the original code for all four
truncated prefixes. After the change, all 14 tests across XmlReader, XmlTree and
XmlTreeSlim passed, including 17 cases for existing BOM and diagnostic behavior.

Checklist

  • Unit tests added and passing.
  • Manual testing: not required; automated regression verified before and after the change.
  • Security impact reviewed: prevents reads beyond the input terminator.
  • Documentation: boundary behavior explained in code.
  • Dependencies and TPIP: unchanged.

@thorstendb-ARM
thorstendb-ARM marked this pull request as ready for review October 22, 2026 12:12
@github-actions

github-actions Bot commented Oct 22, 2026 •

Copy link
Copy Markdown

Test Results

  4 files   -    36   40 suites   - 86   40s ⏱️ - 12m 52s
281 tests  - 1 269  281 ✅  - 1 269  0 💤 ± 0  0 ❌ ±0 
560 runs   - 3 084  560 ✅  - 3 066  0 💤  - 18  0 ❌ ±0 

Results for commit d76916e. ± Comparison against base commit 5f04db7.

This pull request removes 1269 tests.
CrossPlatformUnitTests ‑ CanExecute
CrossPlatformUnitTests ‑ ExecCommand
CrossPlatformUnitTests ‑ GetEnv_Empty
CrossPlatformUnitTests ‑ GetEnv_Existing
CrossPlatformUnitTests ‑ GetEnv_NoExising
CrossPlatformUnitTests ‑ GetExecutablePath
CrossPlatformUnitTests ‑ GetLongPathRegStatus
CrossPlatformUnitTests ‑ GetPackRootDir_Default
CrossPlatformUnitTests ‑ GetPackRootDir_NoEnvSet
CrossPlatformUnitTests ‑ GetPackRootDir_ValidEnvSet
…

♻️ This comment has been updated with latest results.

edriouk
edriouk previously approved these changes Oct 22, 2026

@edriouk edriouk left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

for BOM it is good

@codecov

codecov Bot commented Oct 23, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.45%. Comparing base (5f04db7) to head (d76916e).

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #2667   +/-   ##
=======================================
  Coverage   87.45%   87.45%           
=======================================
  Files         207      207           
  Lines       33545    33545           
=======================================
  Hits        29336    29336           
  Misses       4209     4209           
Flag Coverage Δ
buildmgr-cov 89.51% <ø> (ø)
packchk-cov 80.09% <ø> (ø)
packgen-cov 88.66% <ø> (ø)
projmgr-cov 95.01% <ø> (ø)
svdconv-cov 74.62% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@thorstendb-ARM
thorstendb-ARM merged commit 6cb5a3c into main Oct 23, 2026
148 of 150 checks passed
@thorstendb-ARM
thorstendb-ARM deleted the fix/xmlreader-bom-bounds branch October 23, 2026 07:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants