Repository navigation
Validate server retrieval bounds and add regression tests - #34
Merged
Merged
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
The >= check rejects valid requests when start plus count equals INT_MAX; it should use > and include a regression test confirming that boundary succeeds.
1 open issue
What changed in this PR
This PR hardens server retrieval bounds in yazpp and adds regression tests for Present and piggyback retrieval.
Changes:
- Limit retrieval to 10,000 records and validate bounds before integer conversion, returning failure diagnostics for rejected requests.
- Add server tests for record contents, retrieval behavior, and invalid bounds, registered with
make check. - Refine test artifact ignore patterns and remove trailing whitespace.
| File | Description |
|---|---|
src/yaz-z-server-sr.cpp |
Add retrieval limits, bounds validation, and rejection diagnostics. |
src/test_server.cpp |
Add server search and retrieval regression tests. |
src/test_gdu.cpp |
Remove trailing whitespace in the copyright comment. |
src/Makefile.am |
Register the new server test. |
src/.gitignore |
Narrow test binary patterns and ignore generated test results. |
include/yazpp/z-server.h |
Remove trailing whitespace in the copyright comment. |
Review effort: Balanced
adamdickmeiss
force-pushed
the
yaz-server-bounds-checking
branch
2 times, most recently
from
November 9, 2026 19:22
a980ee1 to
0f8ed58
Compare
There was a problem hiding this comment.
🟡 Changes recommended
A negative mediumSetPresentNumber still reaches the no-retrieval path without a diagnostic, so invalid piggyback counts must be routed through the failure-diagnostic branch.
1 open issue
1 resolved since last review
Review effort: Balanced
adamdickmeiss
force-pushed
the
yaz-server-bounds-checking
branch
from
November 9, 2026 19:30
0f8ed58 to
bea4411
Compare
Limit Present and piggyback retrieval to 10,000 records. Validate counts and start positions before narrowing to int, avoid overflow in range checks, and return failure status with rejection diagnostics. Allow requests whose start plus count equals INT_MAX. Add a yaz/test.h server test covering search, retrieval, record contents, piggyback behavior, invalid bounds, and the INT_MAX equality boundary. Register it with make check. Use odr_booldup and odr_intdup for allocation and initialization. Replace numeric diagnostics with named Bib-1 definitions. Refine ignore patterns for test binaries and generated test results, and remove trailing whitespace. Validation: all three src tests pass.
adamdickmeiss
force-pushed
the
yaz-server-bounds-checking
branch
from
November 9, 2026 19:50
bea4411 to
a7a2610
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Limit Present and piggyback retrieval to 10,000 records. Validate counts and start positions before narrowing to int, avoid overflow in range checks, and return failure status with rejection diagnostics.
Add a yaz/test.h server test covering search, retrieval, record contents, piggyback behavior, and invalid bounds. Register it with make check.
Refine ignore patterns for test binaries and generated test results, and remove trailing whitespace.
Validation: all src tests pass, including the new test under UBSan.