Commit 9d387eb
committed
fix: panic in linear myers algorithm
In `linearSpaceMyersRecWithIndices`, the suffix-scanning loop:
```go
for suffix < n-prefix && a[aEnd-1-suffix] == b[bEnd-1-suffix] {
```
bounds the scan against n-prefix (a's remaining length after prefix) but not against m-prefix (b's remaining length).
With the fuzzer's input a="\n\n\n\n\n\n\n\n\n0" → 10 lines, b="0" → 1 line:
n=10, m=1, prefix=0
suffix=0: a[9]="0" == b[0]="0" → true, suffix becomes 1
suffix=1: tries b[1-1-1] = b[-1] → index out of range panic
Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>1 parent a1f8b87 commit 9d387eb
1 file changed
Lines changed: 18 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
207 | 207 | | |
208 | 208 | | |
209 | 209 | | |
210 | | - | |
| 210 | + | |
211 | 211 | | |
212 | 212 | | |
213 | 213 | | |
| |||
217 | 217 | | |
218 | 218 | | |
219 | 219 | | |
220 | | - | |
| 220 | + | |
221 | 221 | | |
222 | 222 | | |
223 | 223 | | |
| |||
418 | 418 | | |
419 | 419 | | |
420 | 420 | | |
| 421 | + | |
| 422 | + | |
| 423 | + | |
| 424 | + | |
| 425 | + | |
421 | 426 | | |
| 427 | + | |
| 428 | + | |
| 429 | + | |
422 | 430 | | |
423 | 431 | | |
424 | 432 | | |
| |||
480 | 488 | | |
481 | 489 | | |
482 | 490 | | |
| 491 | + | |
| 492 | + | |
| 493 | + | |
| 494 | + | |
| 495 | + | |
483 | 496 | | |
| 497 | + | |
| 498 | + | |
| 499 | + | |
484 | 500 | | |
485 | 501 | | |
486 | 502 | | |
| |||
0 commit comments