format: a chunk offset past usize writes nothing

Placing a chunk cast its u64 offsets to usize; on a 32-bit target an offset past the address space wrapped into the output (and could then overlap another chunk's region when chunks are placed concurrently). Such an offset is past the dataset, so it now saturates and the chunk writes nothing, as the concurrent-placement check already assumed. No change on 64-bit targets, where the cast cannot wrap (so no test here). Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
2026-09-26 10:37:40 -05:00
parent 94b6df986c
commit 8295d01614
1 changed files with 3 additions and 1 deletions
@@ -155,7 +155,9 @@ impl ChunkPlacer {
            &mut long
        };
        for (o, &off) in chunk_offsets.iter_mut().zip(offsets) {
-            *o = off as usize;
+            // An offset past `usize` is past the dataset: the chunk writes
+            // nothing (a plain cast would wrap it into the output).
+            *o = usize::try_from(off).unwrap_or(usize::MAX);
        }
        // SAFETY: the caller's contract.
        unsafe {