fix(io): make link-name fuzz truncation UTF-8 safe

[rmems]

User description

Motivation

• The libFuzzer harness fuzz/fuzz_targets/link_names.rs truncated a lossy UTF-8 String with &s[..128], which can land inside a multi-byte character and panic the fuzz harness.
• The goal is to preserve the existing 128-byte cap but ensure truncation only occurs at a valid UTF-8 character boundary so fuzzing and CI fuzz jobs do not panic.

Description

• Replace the inline truncation in the fuzz target by routing inputs through a new helper fuzz::check_link_name_input and add a new file fuzz/src/lib.rs containing the helper.
• Add const MAX_NAME_BYTES: usize = 128 and a truncate_at_char_boundary(value: &str, max_bytes: usize) -> &str helper that steps back to the previous char boundary rather than slicing at an arbitrary byte index.
• The fuzz helper calls the existing library validators check_link_name and check_hdf5_string so library behavior is unchanged for NULs, /, ., .., and empty names.
• Add a deterministic unit regression in fuzz/src/lib.rs that exercises the 45-byte reproducer (\n\r\n + 42 × 0xe6) to verify the harness no longer panics.

Testing

• Ran cargo fmt --check and the repository formatting check passed.
• Ran the test suite with cargo test, cargo test --features serde, cargo test --all-features, and cargo test --test prop_invariants, and all invoked tests passed.
• Ran cargo clippy --all-targets --all-features -- -D warnings and it completed without warnings.
• Attempted cargo test --manifest-path fuzz/Cargo.toml and cargo +nightly fuzz run link_names -- -max_total_time=30 -seed=1, but both fuzz-related runs could not complete because this environment could not download libfuzzer-sys / nightly toolchain (network proxy returned HTTP 403); the harness logic and deterministic unit test cover the regression despite the unavailable external tooling.

Codex Task

Summary by cubic

Stops the link_names fuzz target from panicking when truncating lossy UTF-8 at 128 bytes lands inside a multi-byte character. Fuzz input now passes through a shared helper that truncates at a valid character boundary, with the stepping loop guarded against underflow, and a regression test covers the 45-byte reproducer. Library validation behavior for NULs, /, ., .., and empty names is unchanged.

^{Written for commit 52b39f7. Summary will update on new commits.}

---

CodeAnt-AI Description

Prevent link-name fuzzing from crashing on multibyte UTF-8 input

What Changed

• Fuzz inputs are truncated to 128 bytes only at valid UTF-8 character boundaries
• Added regression coverage for lossy UTF-8 data that previously could cause a panic
• Link-name and metadata validation continue to receive the same bounded input, including NULs and path separators

Impact

✅ Fuzzing no longer panics on split UTF-8 characters
✅ Stable 128-byte input limit
✅ Regression coverage for invalid UTF-8 truncation

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Relationships

• Opportunistic / Codex-era fix PR — no invented Closes.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Incremental review completed	52b39f7	Sep 22, 2026 · 09:48	09:50
✅ Reviewed your PR	03b8267	Sep 22, 2026 · 08:15	08:16

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[linear-code]

LIM-1287

[deepsource-io]

DeepSource Code Review

We reviewed changes in b4dc783...52b39f7 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Rust		Sep 22, 2026 9:48a.m.	Review ↗
Secrets		Sep 22, 2026 9:48a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Essentials

Run ID: 2e51c728-a124-4470-938e-83f8b4f108a4

📥 Commits

Reviewing files that changed from the base of the PR and between 03b8267 and 52b39f7.

📒 Files selected for processing (1)

• fuzz/src/lib.rs

 _____________________________
< ░R░e░v░i░e░w░ ░i░n░ ░b░i░o░ >
 -----------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Essentials

Run ID: a559438b-5b84-4722-9c9e-96c1399db4d4

📥 Commits

Reviewing files that changed from the base of the PR and between b4dc783 and 03b8267.

📒 Files selected for processing (2)

• fuzz/fuzz_targets/link_names.rs
• fuzz/src/lib.rs

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour.

---

📝 Summary

Summary by CodeRabbit

• Tests
  • Expanded automated coverage for link-name and HDF5 string validation.
  • Added regression checks for invalid UTF-8 input, byte-length limits, and character-boundary handling.
  • Fuzz testing now exercises raw arbitrary byte sequences more directly, improving detection of edge-case validation issues.

Walkthrough

The fuzzing code now centralizes lossy UTF-8 decoding, 128-byte character-safe truncation, and link-name and HDF5-string validation. The link-name fuzz target passes raw input bytes to the shared helper.

Changes

Link-name fuzz input handling

Layer / File(s)	Summary
Shared input validation and regression test fuzz/src/lib.rs	Adds check_link_name_input, bounded character-safe truncation, link-name and HDF5-string validation, and a regression test for invalid UTF-8 input.
Fuzz target integration fuzz/fuzz_targets/link_names.rs	Replaces local decoding, truncation, and separate validation calls with check_link_name_input(data).

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 03b82

The fuzz target now safely bounds UTF-8 input while preserving existing link-name validation, with no current merge-blocking risk remaining.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the UTF-8-safe truncation change, the added helper and regression test, and the validation performed.
Title check	✅ Passed	The title clearly and concisely describes the main change: making link-name fuzz truncation UTF-8 safe.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-22T08:17:30.016002Z	03b8267	PR opened
🔒 Security Review	✅ Completed 2026-09-22T08:17:44.768004Z	03b8267	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[amazon-q-developer]

The PR successfully addresses the UTF-8 truncation panic by introducing UTF-8-aware boundary checking. The refactoring properly extracts the logic into a reusable helper with appropriate test coverage.

Critical Issue:

• The truncate_at_char_boundary function has a potential underflow risk in the while loop that needs to be addressed before merge

Once the loop bounds check is fixed, this will be ready to merge.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 5 complexity · 0 duplication

Metric	Results
Complexity	5
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codeant-ai]

CodeAnt Nitpicks

1 code suggestion

1. Arbitrarily large fuzz inputs are fully converted and allocated before truncation, so the helper can consume substantial memory despite its 128-byte bound.

Performance · fuzz/src/lib.rs:20

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[rmems]

Applied the Amazon Q guard (end > 0 && !is_char_boundary(end)) on the fuzz truncation helper (commit 52b39f7). Will resolve the review thread once CI re-settles.

Cited by: Limen-Neural (Grok Bot)