Six low-severity, latent defects in abc and jab: unchecked streaming writes, extreme-size integer UB feeding mmap, an array overrun only at astronomic offsets, a munmap-failure leak, a signed-negation UB in int formatting, and an unchecked malloc in io.log. None is reachable at realistic sizes today, but each is a real unsafety the style forbids; the goal is defensive hardening (with a repro where feasible).
Latent unsafety, grouped for one cleanup pass.
abc/SKIPx.h:45-67 SKIPfeed — builds u8cs over off + len where len can reach 41 vs off[40], reading one element past the array (only at ~2^48 data lengths); unlike SKIPfinish it does not clamp.abc/MMAP.h:22-34 — round_power_of_2 does 1UL<<64 (UB) for sizes in (2^63,2^64), shrinking the mapping; MMAPmayresize size math can overflow before rounding.abc/MMAP.c:23-31 MMAPresize — non-MREMAP path leaks the new mapping if munmap of the old region fails.abc/DNS.h:219-237 DNSNameText — ignores u8sFeed1/u8sFeed NOROOM, silently truncating the decoded name with no error (no OOB, but style-mandated check missing).abc/UTF8.c:116-127 utf8sFeedInt — u = -*i negates INT64_MIN (signed-overflow UB); utf8sDrainInt already guards the magnitude.jab/io.cpp:971-975 JABCioLog — malloc(max) return unchecked (JS-115 missed this site), then written by JSStringGetUTF8CString: NULL write under OOM; JSValueToStringCopy NULL is unchecked too (only *exception is tested).None. All require extreme inputs or allocator failure.
Re-verified 2026-08-04 at ///jab#9dc100ea (abc now at dog/abc; round_power_of_2 lives in 01.h): all five abc sites still unfixed, plus the sixth jab/io.cpp site found in the same sweep.
- dog/abc/SKIPx.h:67 SKIPfeed — slice still formed over k->off + X(SKIP,len)(pos) with no clamp (off[40] at :20, len can hit 41); cap at sizeof(off)/sizeof(T) like SKIPfinish (:85 has the check). - dog/abc/01.h:242-245 round_power_of_2 — still 1UL << (64 - clz64(a)), UB shift for a in (2^63,2^64); callers MMAPresize4/MMAPmayresize (dog/abc/MMAP.h:25,32) still overflow-prone before rounding. - dog/abc/MMAP.c:27-28 MMAPresize — non-MREMAP path: munmap(old) failure testc-returns leaking new_mem; unmap the new mapping first. - dog/abc/DNS.h:233 DNSNameText — u8sFeed(into, label) return still ignored (silent truncation); the dot feed (:228-230) is now $empty-guarded but the label feed is not. Same unchecked u8sFeed(into, label) pattern at DNS.h:170 and :212. - dog/abc/UTF8.c:119-121 utf8sFeedInt — still u = -*i (INT64_MIN signed-negation UB); compute the magnitude unsigned. - jab/io.cpp:973-974 JABCioLog — check the malloc (throw/skip on NULL) like JABChexDecode (codec.cpp:51-52) does, and NULL-check JSValueToStringCopy at :971 as JABCPath (io.cpp:30) does.
None. All require extreme inputs or allocator failure.