fix: guard sliceDirect against out-of-bounds offsets#2329
Conversation
Add the missing bounds check in sliceDirect so off >= c.size (or negative) returns BytesNotAvailableError instead of panicking on the mmap slice. Also add a focused regression test.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — simple, focused bounds guard with a regression test.
Extended reasoning...
Overview
Adds a 4-line out-of-bounds guard to sliceDirect in cache.go, returning BytesNotAvailableError{} when off < 0 || off >= c.size. Paired with a targeted regression test in cache_test.go.
Security risks
None. The change is purely defensive — it prevents a potential mmap slice panic for callers that pass an out-of-range offset, and it matches the error type already used elsewhere in the file.
Level of scrutiny
Low. This is a minimal, single-concern fix that follows the established pattern used by the Slice method (which guards via isCached). The logic is trivial and the test directly validates both the boundary case (off == size) and a beyond-boundary case (off > size).
Other factors
No bugs found by the bug hunting system. No outstanding reviewer comments. The fix resolves a previously noted review comment on #2306 and the branch is up to date with main.
|
The failure is a race condition introduced by another PR. fied in #2330 |
4 participants
Resolves the review comment on #2306 about missing an out-of-bounds guard.
Changes:
Branch was created from fresh after pulling latest.