v4_manage_serve takes its arguments without checking the stack's depth #169

New Issue

2026-11-11T21:31:53Z

rajames commented

2026-11-11 21:31:53 +00:00

Found

v4/src/manage.c:90 v4_manage_serve() pops 1-4 arguments with v4_dstack_pop() (e.g. NODE-WIRE, line 119) and pushes results, never checking n->ds.depth. v4_dstack_pop on an empty stack does not fault: it returns what is in the ring, so a request with too few values acts on stale numbers, and a push onto a full stack drops the oldest silently -- around the D-16 guards. v4/system/blocks.c:99 refuses exactly this for block requests (the MESH step-6 review). Latent: only v4/tests/test_manage.c calls it today, and it never sends too few values; reachable once MESH steps 8-9 put requests on nodes.

Done when

A test of each request with too few values, seen to fail
Each request refused, as a block request is, when the stack holds fewer values than it takes

🤖 Filed with Claude Code -- the code review of 2026-11-11, at 4d42d25c (Captain Bob, 2026-11-11: "File the review findings as issues"). Read, not run: each is to be confirmed by a test written first and seen to fail.

### Found `v4/src/manage.c:90` `v4_manage_serve()` pops 1-4 arguments with `v4_dstack_pop()` (e.g. NODE-WIRE, line 119) and pushes results, never checking `n->ds.depth`. `v4_dstack_pop` on an empty stack does not fault: it returns what is in the ring, so a request with too few values acts on stale numbers, and a push onto a full stack drops the oldest silently -- around the D-16 guards. `v4/system/blocks.c:99` refuses exactly this for block requests (the MESH step-6 review). Latent: only `v4/tests/test_manage.c` calls it today, and it never sends too few values; reachable once MESH steps 8-9 put requests on nodes. ### Done when - [ ] A test of each request with too few values, seen to fail - [ ] Each request refused, as a block request is, when the stack holds fewer values than it takes 🤖 Filed with [Claude Code](https://claude.com/claude-code) -- the code review of 2026-11-11, at `4d42d25c` (Captain Bob, 2026-11-11: "File the review findings as issues"). Read, not run: each is to be confirmed by a test written first and seen to fail.

rajames added the

area/v4 labels 2026-11-11 21:31:55 +00:00

Sign in to join this conversation.