Files

T

retoorandClaude Opus 4.8 79ae6f27da cpp-safety: safe-C++ playbook, fix a second UB, and a sanitizer net

Response to incident WA-2026-10-27 (the std::vector max_size() crash). Deep
research archived under research/safe-cpp-practices (8 Tier 1, 37 Tier 2, 2
conclusions) on production-safe C++ that keeps development speed: OpenSSF
compiler hardening, the C++ Core Guidelines bounds profile, integer-overflow
practice, libFuzzer/sanitizer CI, the sanitizer overhead ladder, clang-tidy
ratchets.

The research prescribed an ASan+UBSan+_GLIBCXX_ASSERTIONS build of the parsers.
Standing it up immediately caught a second, independent undefined-behavior bug
that two manual reviews had missed: a protobuf varint loop that shifted by up
to 70 bits (shift >= 64 is UB) on malformed input. Fixed and guarded by a
deterministic test and the sanitizer net.

- src/whatsapp/wa_proto.cpp: guard the wire-0 varint shift (the UB).
- tests/whatsapp_test.cpp: add an overlong-varint hostile case.
- tools/san-whatsapp.sh: the standing sanitizer net for detz::wa parsers.
- WaClient frame capture: a frame that fails to decode/dispatch has its exact
  bytes recorded to <home>/whatsapp/last-error.log (bounded), so the still
  unreproduced live <iq> failure becomes a one-paste deterministic fix. Wired
  from the wizard and the whatsapp_send tool.
- docs/cpp-safety.md: the project-wide playbook and design decisions (four
  layers: overflow-safe checked-reader parsing, cheap release hardening, the
  sanitizer test net, capture). docs/whatsapp.md section 13.6 records the
  follow-up and the honest open item. AGENTS.md makes it a standing rule;
  cap.md and mcp.md inherit it for their wire parsers.

Verified: build, whatsapp_test (incl. hostile+fuzz), make lint, and
tools/san-whatsapp.sh all green; research audit PASS.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-10-27 19:03:32 +01:00

3.1 KiB

Raw Blame History

Conclusion: Incident WA-2026-10-27: the length_error crash was a size-arithmetic overflow plus an uncaught exception, and a second UB was found by the fix's own test net

Metadata

Field	Value
Institute	Molodetz Institute — Research & Retrieval Division
Subject	safe-cpp-practices
Document type	Conclusion
Tier	N/A
Date decided	2026-10-27
Decided by	retoor, advised by tai (agent, Claude Opus 4.8)
Status	Active
Confidence	High

Question / problem statement

What was the actual defect behind the cannot create std::vector larger than max_size() abort during --whatsapp-link, and did the first fix fully resolve it?

Conclusion

The primary defect was an overflowable bounds check (pos + len > size wrapping size_t) that let an attacker-sized length reach vector::assign, combined with a node-dispatch loop that did not catch exceptions, so the throw aborted the process. The first fix (commit f16c5c6) made the checks overflow-safe and wrapped dispatch, which stopped the abort but was declared verified on the strength of a hostile-input test that did not exercise the live decode path, which was overconfident. Standing this research up produced the real net: building the parsers under ASan+UBSan+_GLIBCXX_ASSERTIONS immediately surfaced a second, independent undefined-behavior bug that two manual reviews had missed, a varint decode loop that shifted by up to 70 bits (shift >= 64 is UB) on malformed input. That is now fixed and guarded by both a deterministic test and the sanitizer net. The exact live frame that the user hit remains unreproduced in-session; the capture hook will record it on recurrence.

Supporting sources

integer-overflow-size-checks: names the signed/overflow size trap that was the primary defect.
libfuzzer-sanitizer-ci: the sanitizer+fuzz approach that found the second (varint shift) UB.
sanitizer-overhead-maturity-ladder: UBSan as the cheap oracle that catches shift-overflow UB.

Alternatives considered and rejected

Keep patching sites as they are reported (whack-a-mole): rejected, it is what produced the overconfident first fix; a tool-enforced net is the only thing that finds what review misses. Disable the dispatch try/catch to crash loudly in production: rejected, release must degrade gracefully; the sanitizer build is where we crash loudly.

Risks / open questions

The original live frame is still not reproduced, so a third, distinct decode bug on a specific valid node shape cannot be ruled out; the capture hook is the mitigation and must actually be exercised on the user's next run. The sanitizer net covers the parsers it is pointed at; a new parser added without wiring it in is unguarded.

Action taken

Varint shift guard added and tested; frame-capture hook added to WaClient and wired from the wizard and the agent tool; the whole parser suite runs clean under tools/san-whatsapp.sh; documented as incident WA-2026-10-27 in docs/whatsapp.md section 13.

Changelog

Date	Change
2026-10-27	Initial conclusion recorded.

3.1 KiB Raw Blame History