Skip to content

Harden bucket index handling with helpers and bounds checks#12

Merged
laurenshareshian merged 1 commit intomainfrom
harden-bucket-constants
Mar 19, 2026
Merged

Harden bucket index handling with helpers and bounds checks#12
laurenshareshian merged 1 commit intomainfrom
harden-bucket-constants

Conversation

@laurenshareshian
Copy link
Copy Markdown
Collaborator

@laurenshareshian laurenshareshian commented Mar 19, 2026

Summary

  • Add toArrayIndex/toBucketIndex helpers to BucketCreator to replace raw BUCKET_MAX - bucket arithmetic scattered across the codebase
  • Guard against out-of-bounds bucket indices from the public MempoolSnapshot API by checking both lower and upper bounds (BUCKET_MIN..BUCKET_MAX)
  • Assert that BUCKET_MIN matches its documented derivation (round(ln(0.1) * 100))

Context

Follow-up hardening from PR #10 (sub-1 sat/vB support). The previous PR only guarded bucket >= BUCKET_MIN, leaving the upper bound unchecked — a caller using the public MempoolSnapshot constructor with a bucket > BUCKET_MAX would cause a negative array index crash.

Test plan

  • test BUCKET_MIN matches ln(0_1) times 100 rounded — validates constant derivation
  • fromMempoolSnapshot drops buckets above BUCKET_MAX — confirms oversized buckets are silently dropped
  • All existing tests pass (27 tests)

🤖 Generated with Claude Code

Add toArrayIndex/toBucketIndex helpers to replace raw BUCKET_MAX - bucket
arithmetic, guard against out-of-bounds bucket indices from the public
MempoolSnapshot API, and assert BUCKET_MIN matches its documented derivation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@laurenshareshian laurenshareshian marked this pull request as ready for review March 19, 2026 16:22
@laurenshareshian laurenshareshian merged commit 491726b into main Mar 19, 2026
10 checks passed
@laurenshareshian laurenshareshian deleted the harden-bucket-constants branch March 19, 2026 16:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants