Skip to content

Harden AverageElement against malformed and oversized input - #95

Closed
krotname wants to merge 1 commit into
mainfrom
codex/fix-unbounded-stdin-parsing-in-averageelement
Closed

Harden AverageElement against malformed and oversized input#95
krotname wants to merge 1 commit into
mainfrom
codex/fix-unbounded-stdin-parsing-in-averageelement

Conversation

@krotname

@krotname krotname commented Aug 1, 2026

Copy link
Copy Markdown
Owner

Motivation

  • The CLI solver accepted a single unbounded stdin line and immediately split and parsed every token with Integer.valueOf, which allowed EOF, blank, non-numeric tokens, too-few tokens, and extremely long lines to crash or exhaust resources.
  • The previous implementation materialized and sorted the entire input before accessing the second element, enabling memory/CPU exhaustion on attacker-controlled input.
  • The change aims to make input handling robust and to compute the required result without unbounded allocation while preserving the original semantics for valid inputs.

Description

  • Bound stdin processing by adding MAX_INPUT_CHARACTERS = 4096 and a readBoundedLine(Reader) helper that returns null for EOF, blank, or oversized lines.
  • Change solve(Reader, Writer) to use the bounded reader, normalize whitespace with split("\\s+"), and silently ignore invalid, blank, undersized, or oversized input by returning early.
  • Replace stream-based parsing + sorting + toList().get(1) with a linear, constant-space algorithm that scans parsed integers once to compute the second-smallest value and throws IllegalArgumentException for fewer than two values.
  • Add regression tests in src/test/java/coderun/AverageElementTest.java covering empty/blank input, single-value input, non-numeric tokens, oversized input, duplicates, and multi-value behavior, and keep whitespace-normalization test.

Testing

  • Ran the specific unit tests with mvn -q -Dtest=coderun.AverageElementTest test and they passed.
  • Ran the full test suite with mvn -q test and it completed successfully.
  • Verified no git diff --check issues were reported after the changes.

Codex Task

@krotname

krotname commented Aug 1, 2026

Copy link
Copy Markdown
Owner Author

Superseded by the validated combined merge in #115: #115

@krotname krotname closed this Aug 1, 2026
@krotname
krotname deleted the codex/fix-unbounded-stdin-parsing-in-averageelement branch August 1, 2026 02:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant