fix(diff): avoid input-derived Myers allocation arithmetic#3777
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
9a6677b to
32de0f1
Compare
esengine
left a comment
There was a problem hiding this comment.
Nice — this is the approach that actually satisfies the analyzer. By computing min(n+m, maxDiffEdits) and 2*maxD+1 with bounded loops instead of arithmetic on the input lengths, there's no input-derived +/* flowing into the allocation at all, so CodeQL's go/allocation-size-overflow has nothing left to flag — which my earlier clamp couldn't achieve. Both loops are O(maxDiffEdits) and run once per diff, so the cost is nil, and the TestMyersMaxD_CapsWithoutOverflow cases (incl. maxInt) pin the bound. Merging.
Summary
maxDcap without directly adding the two input lengths.2*maxD+1, and cover huge-int inputs with a unit test.Testing
go test ./internal/diff/go test ./...fails ininternal/control:TestRemoveMCPServerRemovesUnconnectedLazyPlaceholdersees locally configured MCP names instead of an empty config.