Skip to content

fix: validate file_size_bytes and footer_size from metadata#66

Merged
zfarrell merged 6 commits intomainfrom
fix/validate-numeric-metadata
Feb 24, 2026
Merged

fix: validate file_size_bytes and footer_size from metadata#66
zfarrell merged 6 commits intomainfrom
fix/validate-numeric-metadata

Conversation

@zfarrell
Copy link
Contributor

Summary

Test plan

  • Test negative file_size_bytes produces clear error
  • Test negative footer_size is gracefully skipped
  • Normal positive values still work
  • cargo test passes

🤖 Generated with Claude Code

zfarrell and others added 6 commits February 24, 2026 21:02
Replace unsafe `as u64` cast for file_size_bytes with `u64::try_from()` + clear error.
Skip negative footer_size values instead of wrapping to huge usize.
Negative values in catalog metadata indicate corruption; now caught early with clear errors.

Closes #58, closes #59

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
resolve_path() returns String, not Result, so .map_err() calls on it
were compile errors. Also apply rustfmt formatting fixes.
Apply validated_file_size() to all unchecked `size_bytes as u64` casts
in build_delete_file_scan() and build_data_file_scan(). Use
usize::try_from() for footer_size casts for 32-bit platform safety.
This prevents negative i64 values from wrapping to huge u64 values.
…cation

Replace bare `footer_size as usize` casts with `usize::try_from(footer_size)`
to prevent silent truncation on 32-bit platforms where a positive i64 value
exceeding u32::MAX would wrap. Apply consistently across table.rs and
table_changes.rs to match the pattern already used in table_deletions.rs.
@zfarrell zfarrell force-pushed the fix/validate-numeric-metadata branch from 9394a57 to 02f04f6 Compare February 24, 2026 20:09
@zfarrell zfarrell merged commit 007eaaa into main Feb 24, 2026
3 checks passed
@zfarrell zfarrell deleted the fix/validate-numeric-metadata branch February 24, 2026 20:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Negative footer_size wraps to usize::MAX via unchecked cast Negative file_size_bytes wraps to u64::MAX via unchecked cast

1 participant