Skip to content

Conversation

@kimkulling
Copy link
Owner

@kimkulling kimkulling commented Aug 25, 2025

Summary by CodeRabbit

  • Refactor
    • Improved internal reference parsing by centralizing a boundary-safe comma check, enhancing readability and reducing duplication.
    • Streamlined conditional logic to make parsing flow clearer and more maintainable.
    • No changes to public APIs or user-facing behavior; functionality remains the same.

@coderabbitai
Copy link

coderabbitai bot commented Aug 25, 2025

Walkthrough

Adds a boundary-checked helper is_comma_or_not_end and replaces direct comma checks in OpenDDLParser::parseReference to prevent accessing beyond the input end.

Changes

Cohort / File(s) Summary
Parser: comma check guard
code/OpenDDLParser.cpp
Introduced static helper is_comma_or_not_end(char* in, char* end); replaced direct Grammar::CommaSeparator[0] comparisons in parseReference with the helper, including inner conditional; no public API changes.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  participant Caller
  participant Parser as OpenDDLParser::parseReference
  participant Helper as is_comma_or_not_end

  Caller->>Parser: parseReference(in, end)
  loop Iterate references
    Parser->>Helper: is_comma_or_not_end(in, end)?
    alt not at end AND comma
      Parser->>Parser: consume comma, advance
    else end or not comma
      Parser->>Parser: proceed without consuming
    end
  end
  Parser-->>Caller: result
Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Assessment against linked issues

Objective Addressed Explanation
Fix heap-buffer-overflow in parseReference (#95)

Assessment against linked issues: Out-of-scope changes

Code Change Explanation
None observed All edits pertain to guarded comma checks within parseReference for the reported overflow.

Poem

I nibble on commas, hop past the end,
Guarding the buffer—your vigilant friend.
With tiny paws, I point and say “stay,”
No overflows sneaking past me today.
Thump-thump! The parser’s path is clear—
A hare’s-eye fix, concise and dear. 🐇✨

Tip

🔌 Remote MCP (Model Context Protocol) integration is now available!

Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats.

✨ Finishing Touches
  • 📝 Generate Docstrings
🧪 Generate unit tests
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch bugfix/fix_parse_reference_issue-95

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share
🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR/Issue comments)

Type @coderabbitai help to get the list of available commands.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Status, Documentation and Community

  • Visit our Status Page to check the current availability of CodeRabbit.
  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

@sonarqubecloud
Copy link

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
code/OpenDDLParser.cpp (1)

1045-1046: Fix potential out-of-bounds read: dereferencing before end-check.

The condition checks *in before verifying in != end. Reverse the order or reuse the new helper to make it safe and consistent.

Apply one of:

-        } while (Grammar::CommaSeparator[0] == *in && in != end);
+        } while (in != end && Grammar::CommaSeparator[0] == *in);

Or, using the helper for consistency:

-        } while (Grammar::CommaSeparator[0] == *in && in != end);
+        } while (is_comma_safe(in, end));
🧹 Nitpick comments (1)
code/OpenDDLParser.cpp (1)

627-630: Good boundary guard; consider clearer name/signature and broader reuse.

The helper prevents dereferencing past end. Two nits to improve clarity and consistency:

  • Rename to reflect semantics (it returns true only when current char is a comma and we’re not at end). Example: is_comma_or_not_end → is_comma_and_not_end or simply is_comma_safe.
  • Accept const char* to better convey that the function doesn’t mutate.

Apply this small refactor and update call sites:

-static bool is_comma_or_not_end(char *in, char *end) {
-    return in != end && Grammar::CommaSeparator[0] == *in;
-}
+static inline bool is_comma_safe(const char *in, const char *end) {
+    return in != end && Grammar::CommaSeparator[0] == *in;
+}

And later uses:

-while (is_comma_or_not_end(in, end)) {
+while (is_comma_safe(in, end)) {
-    if (is_comma_or_not_end(in, end)) {
+    if (is_comma_safe(in, end)) {
📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

  • MCP integration is disabled by default for public repositories
  • Jira integration is disabled by default for public repositories
  • Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 0ffc8c2 and cfccf0f.

📒 Files selected for processing (1)
  • code/OpenDDLParser.cpp (2 hunks)
🧰 Additional context used
🧬 Code graph analysis (1)
code/OpenDDLParser.cpp (2)
test/OpenDDLParserTest.cpp (18)
  • in (87-87)
  • in (427-427)
  • in (453-453)
  • in (475-475)
  • in (505-505)
  • in (561-561)
  • in (616-616)
  • end (88-88)
  • end (322-322)
  • end (336-336)
  • end (347-347)
  • end (359-359)
  • end (370-370)
  • end (396-396)
  • end (519-519)
  • end (551-551)
  • end (595-595)
  • end (616-616)
test/OpenDDLParserUtilsTest.cpp (5)
  • end (38-38)
  • end (282-282)
  • end (293-293)
  • end (318-318)
  • end (328-328)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: PR (address)
🔇 Additional comments (1)
code/OpenDDLParser.cpp (1)

641-651: Refactor the comma-separated parsing loop in parseReference

The current loop in code/OpenDDLParser.cpp (around lines 641–651 in OpenDDLParser::parseReference) only checks for a comma before and after calling getNextSeparator, then breaks—so any comma-initiated names beyond the first never get parsed. Although your unit tests in test/OpenDDLParserTest.cpp already cover a two-element case ("$name1, %name2"), that mask may hide the loop’s flawed logic when more than two references are present.

Please update the parsing to a straightforward “parse → while comma parse” pattern, for example:

-    // after parsing the first name…
-    while (is_comma_or_not_end(in, end)) {
-        in = getNextSeparator(in, end);
-        if (is_comma_or_not_end(in, end)) {
-            in = parseName(in, end, &nextName);
-            if (nextName) {
-                names.push_back(nextName);
-            }
-        } else {
-            break;
-        }
-    }
+    // after parsing the first name, repeatedly consume ", <name>"
+    in = lookForNextToken(in, end);
+    while (in != end && *in == Grammar::CommaSeparator[0]) {
+        ++in;                              // skip the comma
+        in = lookForNextToken(in, end);    // skip whitespace/comments
+        nextName = nullptr;
+        in = parseName(in, end, &nextName);
+        if (nextName) {
+            names.push_back(nextName);
+        }
+        in = lookForNextToken(in, end);    // prepare for next comma
+    }

Action items:

  • Mandatory refactor in OpenDDLParser.cpp within parseReference (around lines 631–651).
  • Enhance tests in test/OpenDDLParserTest.cpp to include three or more comma-separated references (e.g. "$a, %b, $c") and verify all are collected.

This will both simplify the code and ensure full coverage of multi-reference inputs.

@kimkulling kimkulling merged commit 17d5783 into master Aug 25, 2025
3 of 4 checks passed
@kimkulling kimkulling added bug fuzzer Bugs related to fuzzer tests labels Aug 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug fuzzer Bugs related to fuzzer tests

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug: heap-buffer-overflow in ODDLParser::OpenDDLParser::parseReference

3 participants