Skip to content

Validate deque capacity before allocation - #87

Closed
krotname wants to merge 1 commit into
mainfrom
codex/propose-fix-for-deque-vulnerability
Closed

Validate deque capacity before allocation#87
krotname wants to merge 1 commit into
mainfrom
codex/propose-fix-for-deque-vulnerability

Conversation

@krotname

Copy link
Copy Markdown
Owner

Motivation

  • Fix an availability vulnerability where the deque capacity read from stdin was used directly in new int[cap], allowing NegativeArraySizeException for negative input and OutOfMemoryError for very large input.
  • Ensure the CLI kata does not crash or destabilize a shared judge process when given malformed or adversarial stdin.

Description

  • Introduce a MAX_CAPACITY bound (100_000) and a safeCapacity(int) helper to normalize capacities before allocation in src/main/java/algorithms/sprint2/Deque.java.
  • Replace the direct allocation new int[cap] with new int[this.cap] where this.cap is the sanitized value returned by safeCapacity.
  • Treat negative capacities as 0 and cap excessively large capacities to MAX_CAPACITY to avoid allocating uncontrolled memory.
  • Add in-file regression checks exercising negative and very large input cases so malformed stdin produces controlled error outputs instead of crashing.

Testing

  • Compiled the class with javac -d /tmp/deque-classes src/main/java/algorithms/sprint2/Deque.java and the compilation succeeded.
  • Ran the built tests with java -Dos.name=Windows -cp /tmp/deque-classes algorithms.sprint2.Deque which printed Test OK, indicating existing tests pass.
  • Reproduced malformed inputs by piping 1\n-1\npop_front\n and 0\n1000000000\n to the program (the latter with -Xmx32m) and observed controlled error outputs without NegativeArraySizeException or OutOfMemoryError, confirming the fix.

Codex Task

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 958fb4e7db

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/main/java/algorithms/sprint2/Deque.java
@sonarqubecloud

Copy link
Copy Markdown

@codecov

codecov Bot commented Jul 31, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@krotname

krotname commented Aug 1, 2026

Copy link
Copy Markdown
Owner Author

Закрываю как superseded by #116: изменения перенесены в одну проверенную ветку, все review findings учтены; локальный mvn verify прошёл полностью.

@krotname krotname closed this Aug 1, 2026
@krotname
krotname deleted the codex/propose-fix-for-deque-vulnerability branch August 1, 2026 08:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant