Skip to content

Harden PyramidSort input bounds - #83

Closed
krotname wants to merge 1 commit into
mainfrom
codex/propose-fix-for-pyramidsort-vulnerability
Closed

Harden PyramidSort input bounds#83
krotname wants to merge 1 commit into
mainfrom
codex/propose-fix-for-pyramidsort-vulnerability

Conversation

@krotname

Copy link
Copy Markdown
Owner

Motivation

  • The CLI trusted unbounded stdin values which could cause NegativeArraySizeException or OutOfMemoryError when allocating Participant[] or growing token buffers.
  • The numeric parser accepted arbitrary non-whitespace bytes and performed unchecked integer arithmetic, allowing malformed or overflowing integers to be interpreted as participant counts.
  • The token parser doubled a byte buffer with no cap, allowing a single oversized login token to exhaust heap memory.

Description

  • Introduce MAX_PARTICIPANTS and MAX_LOGIN_BYTES constants and enforce them before any large allocation.
  • Harden FastIn.nextInt() by rejecting sign-without-digit, non-digit characters, and integer overflow with explicit NumberFormatException.
  • Cap token growth in FastIn.next() by throwing an IOException when MAX_LOGIN_BYTES is exceeded.
  • Validate the participant count in run() (if (n < 0 || n > MAX_PARTICIPANTS)) before calling new Participant[n].
  • Add src/test/java/algorithms/sprint5/PyramidSortTest.java with unit tests for integer overflow, oversized login tokens, negative participant counts before allocation, and existing sort behavior.

Testing

  • mvn -q -Dtest=algorithms.sprint5.PyramidSortTest test was run and passed after fixing a test invocation detail.
  • mvn -q -DskipTests compile was run and completed successfully.
  • mvn -q test (full test suite) was run and completed successfully.

Codex Task

@codecov

codecov Bot commented Jul 31, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 50.00000% with 1 line in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
src/main/java/algorithms/sprint5/PyramidSort.java 50.00% 0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

@sonarqubecloud

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7035f13b64

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/main/java/algorithms/sprint5/PyramidSort.java
@krotname

krotname commented Aug 1, 2026

Copy link
Copy Markdown
Owner Author

Закрываю как superseded by #116: изменения перенесены в одну проверенную ветку, все review findings учтены; локальный mvn verify прошёл полностью.

@krotname krotname closed this Aug 1, 2026
@krotname
krotname deleted the codex/propose-fix-for-pyramidsort-vulnerability branch August 1, 2026 08:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant