Five low-severity, latent defects in abc: unchecked streaming writes, extreme-size integer UB feeding mmap, an array overrun only at astronomic offsets, a munmap-failure leak, and a signed-negation UB in int formatting. None is reachable at realistic sizes today, but each is a real unsafety the style forbids; the goal is defensive hardening (with a repro where feasible).
Latent unsafety, grouped for one cleanup pass.
abc/SKIPx.h:45-67 SKIPfeed — builds u8cs over off + len where len can reach 41 vs off[40], reading one element past the array (only at ~2^48 data lengths); unlike SKIPfinish it does not clamp.abc/MMAP.h:22-34 — round_power_of_2 does 1UL<<64 (UB) for sizes in (2^63,2^64), shrinking the mapping; MMAPmayresize size math can overflow before rounding.abc/MMAP.c:23-31 MMAPresize — non-MREMAP path leaks the new mapping if munmap of the old region fails.abc/DNS.h:219-237 DNSNameText — ignores u8sFeed1/u8sFeed NOROOM, silently truncating the decoded name with no error (no OOB, but style-mandated check missing).abc/UTF8.c:116-127 utf8sFeedInt — u = -*i negates INT64_MIN (signed-overflow UB); utf8sDrainInt already guards the magnitude.None. All require extreme inputs or allocator failure.
Re-verified 2026-07-07 (abc now at dog/abc; round_power_of_2 lives in 01.h): all five sites unfixed.
- dog/abc/SKIPx.h:67 SKIPfeed — slice still formed over k->off + X(SKIP,len)(pos) with no clamp (off[40] at :20, len can hit 41); cap at sizeof(off)/sizeof(T) like SKIPfinish (:85 has the check). - dog/abc/01.h:242-245 round_power_of_2 — still 1UL << (64 - clz64(a)), UB shift for a in (2^63,2^64); callers MMAPresize4/MMAPmayresize (dog/abc/MMAP.h:25,32) still overflow-prone before rounding. - dog/abc/MMAP.c:27-28 MMAPresize — non-MREMAP path: munmap(old) failure testc-returns leaking new_mem; unmap the new mapping first. - dog/abc/DNS.h:233 DNSNameText — u8sFeed(into, label) return still ignored (silent truncation); the dot feed (:228-230) is now $empty-guarded but the label feed is not. Same unchecked u8sFeed(into, label) pattern at DNS.h:170 and :212. - dog/abc/UTF8.c:119-121 utf8sFeedInt — still u = -*i (INT64_MIN signed-negation UB); compute the magnitude unsigned.
None. All require extreme inputs or allocator failure.