fix(ec2): DescribeVolumes MaxResults guard + change_state TOCTOU + empty-filter-value (bug-hunt)#2297
Merged
Merged
Conversation
…der write + empty-filter-value (bug-hunt) - DescribeVolumes: add validate_max_results(5,1000) guard its 4 sibling paginators already have; MaxResults=0 now returns InvalidParameterValue instead of an empty page with a self-referential nextToken=0 (infinite loop). - change_state (Start/Stop/Terminate): extract check_transition and re-run the transition + stop/termination-protection checks against freshly-re-read state INSIDE the write lock, so a concurrent Terminate landing between the read check and the write can no longer resurrect a terminated instance (finding 4.1). Whole call stays atomic under the held guard. - parse_filters: add indexed_list_keep_empty so a present-but-empty filter value (Filter.N.Value.M=) is a legitimate empty-string member instead of truncating; id-lists keep original empty-terminates semantics (no blast radius on InstanceId.N etc.).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three EC2 bugs from the 2026-07-16 bug-hunt (all silent wrong-behavior):
validate_max_resultsguard.MaxResults=0produced an empty<volumeSet/>plus<nextToken>0</nextToken>pointing back at offset 0 → a paginating client loops forever. Now returnsInvalidParameterValuelike the four siblings (and like AWS).read()guard, dropped it, then applied the new state underwrite()with no re-check. A concurrentTerminateInstanceslanding in the window let aStartInstancesoverwrite code 48 withpending, resurrecting a terminated instance past the boot task's terminal guard. Extractedcheck_transitionand re-run it against freshly re-read state inside the write lock; the whole call is now atomic.Filter.N.Value.M=(a legitimate empty/absent-tag-value filter) truncated the value list. Addedindexed_list_keep_emptyfor filter values; id-lists (InstanceId.Netc.) keep the original empty-terminates semantics so there's no blast radius.Test plan
check_transition_enforces_terminal_and_protection(unit) +start_after_terminate_does_not_resurrect(tokio integration) — resurrection is rejected, state untouched.describe_volumes_rejects_max_results_zero/_above_max,describe_volumes_paginates.indexed_list_empty_value_terminates_for_id_lists,indexed_list_keep_empty_*,parse_filters_keeps_empty_filter_value.cargo test -p fakecloud-ec2 --lib→ 132 passed; clippy--all-targets -D warningsclean; fmt applied.Behavior-only fix — no API-surface, SDK, docs, or count changes.
Summary by cubic
Fixes three EC2 behavior bugs: prevents infinite pagination in DescribeVolumes, makes instance state changes atomic to close a TOCTOU gap, and preserves empty filter values during parsing. Behavior-only and aligns errors with AWS.
MaxResultsrange (5–1000);0or>1000now returnsInvalidParameterValueinstead of looping with a self-referentialNextToken.Filter.N.Value.M=) usingindexed_list_keep_empty; ID lists still treat empty members as terminators.Written for commit 6865aec. Summary will update on new commits.