robobun 9907c2e9fa fix(patch): add bounds checking to prevent segfault during patch application (#21939) ...

## Summary

- Fixes segmentation fault when applying patches with out-of-bounds line
numbers
- Adds comprehensive bounds checking in patch application logic
- Includes regression tests to prevent future issues

## Problem

Previously, malformed patches with line numbers beyond file bounds could
cause segmentation faults by attempting to access memory beyond
allocated array bounds in `addManyAt()` and `replaceRange()` calls.

## Solution

Added bounds validation at four key points in `src/patch.zig`:

1. **Hunk start position validation** (line 283-286) - Ensures hunk
starts within file bounds
2. **Context line validation** (line 294-297) - Validates context lines
exist within bounds
3. **Insertion position validation** (line 302-305) - Checks insertion
position is valid
4. **Deletion range validation** (line 317-320) - Ensures deletion range
is within bounds

All bounds violations now return `EINVAL` error gracefully instead of
crashing.

## Test Coverage

Added comprehensive regression tests in
`test/regression/issue/patch-bounds-check.test.ts`:

- ✅ Out-of-bounds insertion attempts
- ✅ Out-of-bounds deletion attempts  
- ✅ Out-of-bounds context line validation
- ✅ Valid patch application (positive test case)

Tests verify that `bun install` completes gracefully when encountering
malformed patches, with no crashes or memory corruption.

## Test Results

```
bun test v1.2.21
✅ Bounds checking working: bun install completed gracefully despite malformed patch
✅ Bounds checking working: bun install completed gracefully despite deletion beyond bounds
✅ Bounds checking working: bun install completed gracefully despite context lines beyond bounds

 4 pass
 0 fail
 22 expect() calls
Ran 4 tests across 1 file. [4.70s]
```

🤖 Generated with [Claude Code](https://claude.ai/code)

---------

Co-authored-by: Claude Bot <claude-bot@bun.sh>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Jarred Sumner <jarred@jarredsumner.com>
Co-authored-by: Zack Radisic <56137411+zackradisic@users.noreply.github.com>

2025-09-12 23:44:48 -07:00

..

__snapshots__

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

fixtures

fix(install): bun.lockb -> bun.lock with incorrect optional peer dependencies (#16743)

2025-01-26 04:29:54 -08:00

migration

bun.lock migration: fix packages with long version string (#21753)

2025-08-11 16:26:03 -07:00

registry

[PKG-517] fix(install): --linker=isolated should spawn scripts on the main thread (#21425)

2025-07-28 12:29:47 -07:00

actual-package-2.0.0.tgz

implement bunx --package (#21517)

2025-08-12 17:07:46 -07:00

architecture-match.test.ts

Fix edgecase with "os" and "cpu" in bun install (#13848)

2024-09-11 16:47:38 -07:00

bad-workspace.test.ts

run prettier and add back format action (#13722)

2024-09-03 21:32:52 -07:00

bar-0.0.2.tgz

Reorganize tests (#2332)

2023-03-07 12:22:34 -08:00

baz-0.0.3.tgz

Reorganize tests (#2332)

2023-03-07 12:22:34 -08:00

baz-0.0.5.tgz

Reorganize tests (#2332)

2023-03-07 12:22:34 -08:00

boba-0.0.2.tgz

make peer dependencies install by default (#6396)

2023-10-10 20:05:58 -07:00

bun-add.test.ts

Fix tarball URL corruption in package manager (#22523)

2025-09-10 17:36:23 -07:00

bun-audit.test.ts

bun audit add more filtering options (#21833)

2025-08-14 16:36:44 -07:00

bun-create.test.ts

Use ReadableStream.prototype.* in tests instead of new Response(...).* (#20937)

2025-07-14 00:47:53 -07:00

bun-info.test.ts

Use ReadableStream.prototype.* in tests instead of new Response(...).* (#20937)

2025-07-14 00:47:53 -07:00

bun-install-dep.test.ts

run prettier and add back format action (#13722)

2024-09-03 21:32:52 -07:00

bun-install-lifecycle-scripts.test.ts

Fix isolated install atomics/synchronization (#21365)

2025-07-25 16:17:50 -07:00

bun-install-patch.test.ts

fix(patch): add bounds checking to prevent segfault during patch application (#21939)

2025-09-12 23:44:48 -07:00

bun-install-pathname-trailing-slash.test.ts

run prettier and add back format action (#13722)

2024-09-03 21:32:52 -07:00

bun-install-proxy.test.ts

fix(install/fetch) proper handle proxy (#19771)

2025-05-20 21:11:22 -07:00

bun-install-registry.test.ts

add catalog support to bun (outdated|update -i) and --filter to bun update -i (#21482)

2025-08-05 05:12:22 -07:00

bun-install-retry.test.ts

Use ReadableStream.prototype.* in tests instead of new Response(...).* (#20937)

2025-07-14 00:47:53 -07:00

bun-install-security-provider.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-install.test.ts

make bun ci work as alias of --frozen-lockfile (like npm ci) (#20590)

2025-07-17 05:41:06 -07:00

bun-link.test.ts

Use ReadableStream.prototype.* in tests instead of new Response(...).* (#20937)

2025-07-14 00:47:53 -07:00

bun-lock.test.ts

fix(install): fix resolving duplicate dependencies (#21059)

2025-07-16 01:01:10 -07:00

bun-lockb.test.ts

Use ReadableStream.prototype.* in tests instead of new Response(...).* (#20937)

2025-07-14 00:47:53 -07:00

bun-pack.test.ts

Add --quiet flag to bun pm pack command (#21053)

2025-07-15 01:14:58 -07:00

bun-patch.test.ts

run prettier and add back format action (#13722)

2024-09-03 21:32:52 -07:00

bun-pm-pkg.test.ts

implement bun pm pkg (#21046)

2025-07-15 22:14:00 -07:00

bun-pm-scan.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-pm-version.test.ts

followup for bun pm version (#20799)

2025-07-07 11:21:36 -07:00

bun-pm-why.test.ts

Implement bun why (#20847)

2025-07-16 02:00:53 -07:00

bun-pm.test.ts

Use ReadableStream.prototype.* in tests instead of new Response(...).* (#20937)

2025-07-14 00:47:53 -07:00

bun-publish.test.ts

Use ReadableStream.prototype.* in tests instead of new Response(...).* (#20937)

2025-07-14 00:47:53 -07:00

bun-remove.test.ts

Use ReadableStream.prototype.* in tests instead of new Response(...).* (#20937)

2025-07-14 00:47:53 -07:00

bun-repl.test.ts

run prettier and add back format action (#13722)

2024-09-03 21:32:52 -07:00

bun-run-bunfig.test.ts

run prettier and add back format action (#13722)

2024-09-03 21:32:52 -07:00

bun-run-dir.test.ts

Unskip some tests (#22116)

2025-08-27 06:39:11 -07:00

bun-run.test.ts

Unskip some tests (#22116)

2025-08-27 06:39:11 -07:00

bun-security-scanner-matrix-runner.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-security-scanner-matrix-with-node-modules.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-security-scanner-matrix-without-node-modules.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-update-security-edge-cases.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-update-security-provider.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-update-security-scan-all.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-update-security-simple.test.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

bun-update.test.ts

add catalog support to bun (outdated|update -i) and --filter to bun update -i (#21482)

2025-08-05 05:12:22 -07:00

bun-upgrade.test.ts

Use ReadableStream.prototype.* in tests instead of new Response(...).* (#20937)

2025-07-14 00:47:53 -07:00

bun-workspaces.test.ts

fix(install): fix resolving duplicate dependencies (#21059)

2025-07-16 01:01:10 -07:00

bun.lockb.bin-linking

Make bun.lock the default for new projects (#16540)

2025-01-20 23:17:52 -08:00

bunx.test.ts

implement bunx --package (#21517)

2025-08-12 17:07:46 -07:00

catalogs.test.ts

Allow "catalog" and "catalogs" in top-level package.json if it wasn't provided in "workspaces" object (#21009)

2025-07-15 22:14:27 -07:00

depends-on-monkey-0.0.2.tgz

bun install Security Scanner API (#21183)

2025-08-21 14:53:50 -07:00

dummy.registry.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

generate-scanner-tarballs.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

is-even-1.0.0.tgz

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

is-odd-1.0.0.tgz

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

isolated-install.test.ts

[PKG-517] fix(install): --linker=isolated should spawn scripts on the main thread (#21425)

2025-07-28 12:29:47 -07:00

left-pad-1.3.0.tgz

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

loader-runner-4.3.0.tgz

fix install test

2023-10-12 15:17:03 -07:00

lockfile-only.test.ts

Optimize --lockfile-only to skip tarball downloads (#21768)

2025-08-12 22:19:10 -07:00

missing-directory-bin-1.1.1.tgz

start verdaccio in multiple test files (#16118)

2025-01-03 08:21:00 -08:00

monkey-0.0.2.tgz

bun install Security Scanner API (#21183)

2025-08-21 14:53:50 -07:00

moo-0.1.0.tgz

[install] fix re-run of tarball URL from lockfile (#2507)

2023-03-29 20:38:19 -07:00

moo-0.2.0.tgz

fix installing dependencies that match workspace versions (#6494)

2023-10-13 20:37:48 -07:00

multi-tool-pkg-1.0.0.tgz

implement bunx --package (#21517)

2025-08-12 17:07:46 -07:00

my-special-pkg-1.0.0.tgz

implement bunx --package (#21517)

2025-08-12 17:07:46 -07:00

npmrc.test.ts

Use ReadableStream.prototype.* in tests instead of new Response(...).* (#20937)

2025-07-14 00:47:53 -07:00

overrides.test.ts

Use ReadableStream.prototype.* in tests instead of new Response(...).* (#20937)

2025-07-14 00:47:53 -07:00

peer-0.0.1.tgz

make peer dependencies install by default (#6396)

2023-10-10 20:05:58 -07:00

peer-0.0.2.tgz

make peer dependencies install by default (#6396)

2023-10-10 20:05:58 -07:00

pkg-only-owner-2.2.2.tgz

fix(install): ensure read permissions when extracting files (#14511)

2024-10-12 02:37:51 -07:00

print-pm-1.0.0.tgz

fix(bun_shim_impl): pass env to CreateProcessW (#11817)

2024-06-12 16:50:57 -07:00

qux-0.0.2.tgz

add default trustedDependencies and run lifecycle scripts during installation (#7132)

2023-12-11 22:08:25 -08:00

redacted-config-logs.test.ts

Fix formatters not running in CI + delete unnecessary files (#19433)

2025-05-08 23:22:16 -07:00

runner-pkg-3.0.0.tgz

implement bunx --package (#21517)

2025-08-12 17:07:46 -07:00

semver-fixture.js

install: dont crash in debug mode when a semver has a build tag and multiple hyphens in the pre-release tag (#9288)

2024-03-06 20:38:49 -08:00

semver.test.ts

fix(install): semver tag parsing bugfix (#11387)

2024-05-27 02:17:43 -07:00

simple-dummy-registry.ts

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

test-dev-peer-dependency-priority.test.ts

fix(install): fix resolving duplicate dependencies (#21059)

2025-07-16 01:01:10 -07:00

test-security-scanner-1.0.0-clean.tgz

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

test-security-scanner-1.0.0-fatal.tgz

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

test-security-scanner-1.0.0-warn.tgz

fix: scanner on update, install, remove, uninstall and add, and introduce the pm scan command (#22193)

2025-09-09 21:42:01 -07:00

vendor-baz-0.0.1.tgz

fix: install vendored node_modules when using hardlinks (#9007)

2024-02-19 22:50:24 -08:00