peach-android / a9558300f7b0

bound Codex shard geometry before anything is allocated from it (v2.14.81) PAI-2026-002: a v3 envelope's per-chunk hash covers only the decoded data bytes, so t/S/s/i were unauthenticated integers that reconstructCompressed fed straight into Array(total) and BooleanArray(total). A barcode with a correct hash over a tiny payload and t = Int.MAX_VALUE therefore cost a multi-gigabyte allocation and killed the process before the payload was ever authenticated. CodexCodec.isValidEnvelope now gates every scanned code on the encoder's own bounds: v, verify-code shape, stripe count <= the ceiling implied by the 16 MiB inflate cap, stripe and shard indices inside their declared ranges, the GF(2^8) 255-shard ceiling, 200 data shards, and exactly CHUNK_SIZE decoded bytes. Invalid geometry is skipped like any unreadable code, so a damaged code still cannot abort an otherwise good restore. Reconstruction additionally rejects mixed verify codes, mixed stripe counts, and mixed shard totals within one stripe instead of silently interleaving two Codexes. Verification: six new hostile-envelope cases, including one that proves real codes still restore alongside rejected ones; full JVM suite 1028 tests / 0 failures / 0 errors / 2 skipped, up from 1022; lintDebug 0 errors and 90 warnings, unchanged; assembleDebug and debug androidTest sources compile.

dev · 1 week ago · 2026-09-01 · 6.7 MB

session: resolve independent audit findings · agent: hy4-preview

parent: 899b79c9c90a