Lower-severity correctness, UB, and API-consistency items from the review. None is individually urgent; grouped so they land in one hardening pass. Each is a one-liner with a cited site; split out any that grows a repro of its own (per Tickets, a bug found mid-fix becomes its own ticket). Method: Issues.
git/GIT.c:163-173 git_drain_decimal does v=v*10+digit on a signed i64
with no bound → signed-overflow UB on a long digit run in a commit timestamp
(flows into gmtime_r). Parse into u64 with an overflow guard / cap digits.git/SHA1.h:17-21 sha1empty reads the u8[20] struct via u64*/u32*
casts — strict-aliasing + unaligned-load UB. Use memcmp vs a 20-byte zero.DOG.c:761-828 DOGutf8sFeedDate uses non-reentrant localtime; correct
today (copies immediately) but localtime_r is the trivial fix (and check
abc/INT.h/TTY.h for an existing date formatter before the month/day tables).DPATH.h:126-136 DPATHBranchResolveRel resolves only ONE ..//./ level,
then fails ../../x with PATHBAD; the header's "../X, .." oversells it.
Loop the prefix-strip or document the single-level limit.DOG.c:723,742,835,848 index FILE_WANT_BUFS[fd] with a u64 fd read back
from the kv store, unchecked; a stale/corrupt value is an OOB read of the fd
table. Bound-check fd < FILE_MAX_OPEN before indexing.NEIL.c:483-523 neil_shift_pass → NEILTokEq (:61-74) → tok32Val indexes
toks[0][i] bounding the 24-bit offset wrap but NOT the token index — the bound
NEILCleanup added (:164-169) and NEILBoundaryScore/NEILIsIdent have.
NEILShift is public (NEIL.h:41); an over-run/mismatched EDL (the documented
Myers-NOROOM fallback shape) reads far OOB. Latent via the current WEAVE caller.ULOG.c:334-339 ulog_idx_scan_cap assumes SNOROOM-checked) — availability only. Size the cap by the min row width.HOME.c:190-200 HOMEProjectExists: impl comment says it checks refs
non-empty, header (HOME.h:198-203) says existence-only; code does existence
only. Delete the stale comment and pin the behaviour with a test (upload-pack
fast-fail depends on it).ULOG.h:200-204 ULOGClose rw flag is caller-replayed state — passing
rw=YES after an RO-ish open FILETrimBooks (ftruncate) a file it never
owned for write; derive the mode from the booked fd instead.ULOG.c:892 ULOGCompactLatest tmp-path feeds path unchecked and (unlike
ulog_idx_path :299-300) does not strip trailing NULs — a NUL-padded slice
makes unlink(tmp_path) (:897) delete the LIVE log. Match the sibling's trim.ULOG.c:325 ULOG_FAULT_ALLOC_ANON is a mutable global fault injector
compiled into release; gate behind a build flag / setter.ULOG.c:1078 merge-walk silently drops tie-group members past
LSM_MAX_INPUTS(64) — records are user data, deserves an error.home_git_config_get collapses "unset" and
"spawn failed" into NODATA (HOME.c:62); HOMEResolveSibling always falls
back to OK with a bare name so callers can't tell "found" from "guessing"
(:1011,1099-1102); VERSNReport/WEAVEScope return decorative ok64.dog/ + dog/git libdog, ABC style.git_drain_decimal overflow, sha1empty aliasing, localtime_r.FILE_WANT_BUFS[fd], neil_shift_pass token index, ULOG tmp-path
NUL strip, ulog_idx_scan_cap min-row sizing.HOMEProjectExists comment+test, ULOGClose rw derivation,
fault-injector gating, tie-cap error, DPATHBranchResolveRel doc/loop.79612854 — git_drain_decimal v*10 GIT.c:167, sha1empty u64c*/u32c* casts SHA1.h:17-21, unchecked FILE_WANT_BUFS[fd] DOG.c:723,742,835,848, ULOG_FAULT_ALLOC_ANON live, LSM_MAX_INPUTS silent drop ULOG.c:1065,1080. ULOG-003 be89684d grew only the BOOKED sidecar (ulog_idx_push FILEBookEnsure); the anon ulog_idx_scan_cap /16 sizing (ULOG.c:334-339) is unchanged — re-check that sub-item against ULOG-003 semantics when fixing. WIP UNLANDED in worktree ~/src/DOG-016.