Conversation
Signed-off-by: Eduardo Silva <eduardo@chronosphere.io>
📝 WalkthroughWalkthroughCFL library enhanced from version 0.6 to 0.7 with platform-specific atomic operations (MSVC, GCC, generic pthread), recursive container containment detection to prevent cyclic structures, and systematic hardening throughout with NULL input validation, integer overflow protection, and JSON string escaping. Extensive test coverage added for atomic operations, null inputs, edge cases, and cycle prevention across all core modules. ChangesCFL Core Library Enhancement
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c80159a0c0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| elseif("${CMAKE_C_COMPILER_ID}" STREQUAL "GNU") | ||
| set(PLATFORM_SPECIFIC_ATOMIC_MODULE cfl_atomic_gcc.c) |
There was a problem hiding this comment.
When CFL is built with GCC/Clang on targets that cannot inline 64-bit __atomic_* operations (for example several 32-bit embedded architectures), this branch selects cfl_atomic_gcc.c/cfl_atomic_clang.c but never adds -latomic; the new implementation uses 64-bit __atomic_compare_exchange, __atomic_store_n, and __atomic_load_n, so executables that reference the new cfl_atomic_* API can fail at link time with unresolved __atomic_*_8 symbols. Please either probe/link atomic for these compiler branches or fall back to the mutex implementation when the builtins are not linkable.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
lib/cfl/AGENTS.md (1)
1-77: ⚡ Quick winKeep vendor bump PRs free of local process docs
Please avoid introducing
lib/cfl/AGENTS.mdin this dependency-upgrade PR. For Line 1 onward, this adds repo-local workflow policy inside vendored code and will likely increase drift/merge friction on future upstream CFL syncs. Consider moving this guidance to a top-level maintainer doc (or a separate PR) and keeping this PR limited to thev0.7.0vendor update.Based on learnings: "Prefer minimal patches that avoid unrelated formatting or refactoring churn" and "Do not mix unrelated code and documentation updates in one commit unless explicitly requested."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@lib/cfl/AGENTS.md` around lines 1 - 77, Remove lib/cfl/AGENTS.md from this vendor bump PR and keep the change focused on the v0.7.0 dependency update; either relocate the guidance into a top-level maintainer document (e.g., MAINTAINERS.md) or open a separate PR for workflow/process docs, and ensure the commit/PR only contains the vendor upgrade files referenced in this diff.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@lib/cfl/src/cfl_sds.c`:
- Around line 227-229: The bounds check in cfl_sds.c for self-append slice
validation is off-by-one: replace the conditional that currently uses "if
(append_len - 1 > head->alloc - source_offset)" with a comparison using ">=" so
that when the source slice ends exactly at head->alloc it is rejected; update
the check around the variables append_len, source_offset and head->alloc in the
same block (the self-append slice validation) to use ">=" to prevent reading
s[head->alloc].
---
Nitpick comments:
In `@lib/cfl/AGENTS.md`:
- Around line 1-77: Remove lib/cfl/AGENTS.md from this vendor bump PR and keep
the change focused on the v0.7.0 dependency update; either relocate the guidance
into a top-level maintainer document (e.g., MAINTAINERS.md) or open a separate
PR for workflow/process docs, and ensure the commit/PR only contains the vendor
upgrade files referenced in this diff.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: f9000ea8-4e50-4221-a359-e81fc01b0ac0
📒 Files selected for processing (45)
lib/cfl/.github/workflows/build.yamllib/cfl/.github/workflows/lint.yamllib/cfl/.github/workflows/packages.yamllib/cfl/AGENTS.mdlib/cfl/CMakeLists.txtlib/cfl/README.mdlib/cfl/include/cfl/cfl.hlib/cfl/include/cfl/cfl_array.hlib/cfl/include/cfl/cfl_atomic.hlib/cfl/include/cfl/cfl_checksum.hlib/cfl/include/cfl/cfl_container.hlib/cfl/include/cfl/cfl_kv.hlib/cfl/include/cfl/cfl_kvlist.hlib/cfl/include/cfl/cfl_list.hlib/cfl/include/cfl/cfl_object.hlib/cfl/include/cfl/cfl_sds.hlib/cfl/include/cfl/cfl_time.hlib/cfl/include/cfl/cfl_utils.hlib/cfl/include/cfl/cfl_variant.hlib/cfl/src/CMakeLists.txtlib/cfl/src/cfl.clib/cfl/src/cfl_array.clib/cfl/src/cfl_atomic_clang.clib/cfl/src/cfl_atomic_gcc.clib/cfl/src/cfl_atomic_generic.clib/cfl/src/cfl_atomic_msvc.clib/cfl/src/cfl_checksum.clib/cfl/src/cfl_container.clib/cfl/src/cfl_kv.clib/cfl/src/cfl_kvlist.clib/cfl/src/cfl_object.clib/cfl/src/cfl_sds.clib/cfl/src/cfl_utils.clib/cfl/src/cfl_variant.clib/cfl/tests/CMakeLists.txtlib/cfl/tests/array.clib/cfl/tests/atomic_operations.clib/cfl/tests/checksum.clib/cfl/tests/headers.clib/cfl/tests/kv.clib/cfl/tests/kvlist.clib/cfl/tests/object.clib/cfl/tests/sds.clib/cfl/tests/utils.clib/cfl/tests/variant.c
| if (append_len - 1 > head->alloc - source_offset) { | ||
| return NULL; | ||
| } |
There was a problem hiding this comment.
Off-by-one error in self-append slice validation.
The check on line 227 should use >= instead of >. When the source slice ends exactly at head->alloc, the last byte is out of bounds.
Example: if head->alloc = 10, source_offset = 5, and append_len = 6, the code attempts to read s[10] which is beyond the allocated buffer (valid indices are 0-9), but the current check 5 > 5 evaluates to false and allows it.
🔧 Proposed fix
- if (append_len - 1 > head->alloc - source_offset) {
+ if (append_len > head->alloc - source_offset) {
return NULL;
}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@lib/cfl/src/cfl_sds.c` around lines 227 - 229, The bounds check in cfl_sds.c
for self-append slice validation is off-by-one: replace the conditional that
currently uses "if (append_len - 1 > head->alloc - source_offset)" with a
comparison using ">=" so that when the source slice ends exactly at head->alloc
it is rejected; update the check around the variables append_len, source_offset
and head->alloc in the same block (the self-append slice validation) to use ">="
to prevent reading s[head->alloc].
1 participant
Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.