Fix panics from fuzzing: checked byte helpers + TIFF parser hardening

[lilith]

Summary

• Convert byte-reading helpers to use checked_add + .get(), returning 0 on out-of-bounds instead of panicking — same function signatures, no caller changes
• Harden TIFF parser: TiffEntry::new() returns Result with bounds validation, makernote parser uses .get() for magic-byte comparisons, FUJIFILM/IFD entry count validated
• X3fDecoder::new() returns Result instead of .unwrap()
• 4 unit tests + 9 integration tests covering valid-data equivalence, OOB behavior, usize overflow, and truncated/crafted inputs

See #54 for the discussion and approach comparison.

Why returning 0 is safe

The helpers are called in two contexts:

1. Bit pumps / decode loops — stuffing zeros at end-of-stream is standard behavior, and chunks_exact() already guarantees bounds for the packed decoders, so the OOB case can't happen there anyway.
2. Metadata parsing — a truncated field reading as 0 falls through to existing error handling (tag not found, invalid offset, etc). The targeted bounds checks in TiffEntry::new() and the IFD loop catch the cases where 0 would cause a downstream slice panic.

Unit tests verify the checked helpers return identical values to the originals for every valid position. The checked_add in the helpers also prevents a usize overflow panic when pos is near usize::MAX (caught by tests).

No performance impact

cargo asm confirms decode_16le produces identical assembly before and after. The entire release .rlib has zero panic_bounds_check calls — LLVM eliminates every bounds check, same as the original. Benchmarked with the built-in benchmark binary on DNG (LJPEG) and CR2 (LJPEG+Huffman) files — within run-to-run noise, no measurable difference.

Test plan

• checked_helpers_match_unchecked_for_valid_data — no silent data corruption
• checked_helpers_return_zero_on_oob — boundary, past-boundary, empty buffer
• checked_helpers_no_wraparound_on_huge_pos — usize::MAX doesn't wrap
• endian_methods_match_free_functions — Endian wrappers delegate correctly
• 3 original fuzzing panic reproducers (FUJIFILM, X3F, TIFF IFD count)
• Truncated TIFF, crafted IFD data offset, FUJIFILM at every length 8–107
• Empty, 1-byte, and random-noise inputs

[lilith]

Summary

• Convert byte-reading helpers to use checked_add + .get(), returning 0 on out-of-bounds instead of panicking — same function signatures, no caller changes
• Harden TIFF parser: TiffEntry::new() returns Result with bounds validation, makernote parser uses .get() for magic-byte comparisons, FUJIFILM/IFD entry count validated
• X3fDecoder::new() returns Result instead of .unwrap()
• 4 unit tests + 9 integration tests covering valid-data equivalence, OOB behavior, usize overflow, and truncated/crafted inputs

See #54 for the discussion and approach comparison.

Why returning 0 is safe

The helpers are called in two contexts:

1. Bit pumps / decode loops — stuffing zeros at end-of-stream is standard behavior, and chunks_exact() already guarantees bounds for the packed decoders, so the OOB case can't happen there anyway.
2. Metadata parsing — a truncated field reading as 0 falls through to existing error handling (tag not found, invalid offset, etc). The targeted bounds checks in TiffEntry::new() and the IFD loop catch the cases where 0 would cause a downstream slice panic.

Unit tests verify the checked helpers return identical values to the originals for every valid position. The checked_add in the helpers also prevents a usize overflow panic when pos is near usize::MAX (caught by tests).

No performance impact

cargo asm confirms decode_16le produces identical assembly before and after. The entire release .rlib has zero panic_bounds_check calls — LLVM eliminates every bounds check, same as the original. Benchmarked with the built-in benchmark binary on DNG (LJPEG) and CR2 (LJPEG+Huffman) files — within run-to-run noise, no measurable difference.

Test plan

• checked_helpers_match_unchecked_for_valid_data — no silent data corruption
• checked_helpers_return_zero_on_oob — boundary, past-boundary, empty buffer
• checked_helpers_no_wraparound_on_huge_pos — usize::MAX doesn't wrap
• endian_methods_match_free_functions — Endian wrappers delegate correctly
• 3 original fuzzing panic reproducers (FUJIFILM, X3F, TIFF IFD count)
• Truncated TIFF, crafted IFD data offset, FUJIFILM at every length 8–107
• Empty, 1-byte, and random-noise inputs

[lilith]

Summary

• Convert byte-reading helpers to use checked_add + .get(), returning 0 on out-of-bounds instead of panicking — same function signatures, no caller changes
• Harden TIFF parser: TiffEntry::new() returns Result with bounds validation, makernote parser uses .get() for magic-byte comparisons, FUJIFILM/IFD entry count validated
• X3fDecoder::new() returns Result instead of .unwrap()
• 4 unit tests + 9 integration tests covering valid-data equivalence, OOB behavior, usize overflow, and truncated/crafted inputs

See #54 for the discussion and approach comparison.

Why returning 0 is safe

The helpers are called in two contexts:

1. Bit pumps / decode loops — stuffing zeros at end-of-stream is standard behavior, and chunks_exact() already guarantees bounds for the packed decoders, so the OOB case can't happen there anyway.
2. Metadata parsing — a truncated field reading as 0 falls through to existing error handling (tag not found, invalid offset, etc). The targeted bounds checks in TiffEntry::new() and the IFD loop catch the cases where 0 would cause a downstream slice panic.

Unit tests verify the checked helpers return identical values to the originals for every valid position. The checked_add in the helpers also prevents a usize overflow panic when pos is near usize::MAX (caught by tests).

No performance impact

cargo asm confirms decode_16le produces identical assembly before and after. The entire release .rlib has zero panic_bounds_check calls — LLVM eliminates every bounds check, same as the original. Benchmarked with the built-in benchmark binary on DNG (LJPEG) and CR2 (LJPEG+Huffman) files — within run-to-run noise, no measurable difference.

Test plan

• checked_helpers_match_unchecked_for_valid_data — no silent data corruption
• checked_helpers_return_zero_on_oob — boundary, past-boundary, empty buffer
• checked_helpers_no_wraparound_on_huge_pos — usize::MAX doesn't wrap
• endian_methods_match_free_functions — Endian wrappers delegate correctly
• 3 original fuzzing panic reproducers (FUJIFILM, X3F, TIFF IFD count)
• Truncated TIFF, crafted IFD data offset, FUJIFILM at every length 8–107
• Empty, 1-byte, and random-noise inputs

[lilith]

Summary

• Convert byte-reading helpers to use checked_add + .get(), returning 0 on out-of-bounds instead of panicking — same function signatures, no caller changes
• Harden TIFF parser: TiffEntry::new() returns Result with bounds validation, makernote parser uses .get() for magic-byte comparisons, FUJIFILM/IFD entry count validated
• X3fDecoder::new() returns Result instead of .unwrap()
• 4 unit tests + 9 integration tests covering valid-data equivalence, OOB behavior, usize overflow, and truncated/crafted inputs

See #54 for the discussion and approach comparison.

Why returning 0 is safe

The helpers are called in two contexts:

1. Bit pumps / decode loops — stuffing zeros at end-of-stream is standard behavior, and chunks_exact() already guarantees bounds for the packed decoders, so the OOB case can't happen there anyway.
2. Metadata parsing — a truncated field reading as 0 falls through to existing error handling (tag not found, invalid offset, etc). The targeted bounds checks in TiffEntry::new() and the IFD loop catch the cases where 0 would cause a downstream slice panic.

Unit tests verify the checked helpers return identical values to the originals for every valid position. The checked_add in the helpers also prevents a usize overflow panic when pos is near usize::MAX (caught by tests).

No performance impact

cargo asm confirms decode_16le produces identical assembly before and after. The entire release .rlib has zero panic_bounds_check calls — LLVM eliminates every bounds check, same as the original. Benchmarked with the built-in benchmark binary on DNG (LJPEG) and CR2 (LJPEG+Huffman) files — within run-to-run noise, no measurable difference.

Test plan

• checked_helpers_match_unchecked_for_valid_data — no silent data corruption
• checked_helpers_return_zero_on_oob — boundary, past-boundary, empty buffer
• checked_helpers_no_wraparound_on_huge_pos — usize::MAX doesn't wrap
• endian_methods_match_free_functions — Endian wrappers delegate correctly
• 3 original fuzzing panic reproducers (FUJIFILM, X3F, TIFF IFD count)
• Truncated TIFF, crafted IFD data offset, FUJIFILM at every length 8–107
• Empty, 1-byte, and random-noise inputs

[lilith]

Summary

• Convert byte-reading helpers to use checked_add + .get(), returning 0 on out-of-bounds instead of panicking — same function signatures, no caller changes
• Harden TIFF parser: TiffEntry::new() returns Result with bounds validation, makernote parser uses .get() for magic-byte comparisons, FUJIFILM/IFD entry count validated
• X3fDecoder::new() returns Result instead of .unwrap()
• 4 unit tests + 9 integration tests covering valid-data equivalence, OOB behavior, usize overflow, and truncated/crafted inputs

See #54 for the discussion and approach comparison.

Why returning 0 is safe

The helpers are called in two contexts:

1. Bit pumps / decode loops — stuffing zeros at end-of-stream is standard behavior, and chunks_exact() already guarantees bounds for the packed decoders, so the OOB case can't happen there anyway.
2. Metadata parsing — a truncated field reading as 0 falls through to existing error handling (tag not found, invalid offset, etc). The targeted bounds checks in TiffEntry::new() and the IFD loop catch the cases where 0 would cause a downstream slice panic.

Unit tests verify the checked helpers return identical values to the originals for every valid position. The checked_add in the helpers also prevents a usize overflow panic when pos is near usize::MAX (caught by tests).

No performance impact

cargo asm confirms decode_16le produces identical assembly before and after. The entire release .rlib has zero panic_bounds_check calls — LLVM eliminates every bounds check, same as the original. Benchmarked with the built-in benchmark binary on DNG (LJPEG) and CR2 (LJPEG+Huffman) files — within run-to-run noise, no measurable difference.

Test plan

• checked_helpers_match_unchecked_for_valid_data — no silent data corruption
• checked_helpers_return_zero_on_oob — boundary, past-boundary, empty buffer
• checked_helpers_no_wraparound_on_huge_pos — usize::MAX doesn't wrap
• endian_methods_match_free_functions — Endian wrappers delegate correctly
• 3 original fuzzing panic reproducers (FUJIFILM, X3F, TIFF IFD count)
• Truncated TIFF, crafted IFD data offset, FUJIFILM at every length 8–107
• Empty, 1-byte, and random-noise inputs

[lilith]

Summary

• Convert byte-reading helpers to use checked_add + .get(), returning 0 on out-of-bounds instead of panicking — same function signatures, no caller changes
• Harden TIFF parser: TiffEntry::new() returns Result with bounds validation, makernote parser uses .get() for magic-byte comparisons, FUJIFILM/IFD entry count validated
• X3fDecoder::new() returns Result instead of .unwrap()
• 4 unit tests + 9 integration tests covering valid-data equivalence, OOB behavior, usize overflow, and truncated/crafted inputs

See #54 for the discussion and approach comparison.

Why returning 0 is safe

The helpers are called in two contexts:

1. Bit pumps / decode loops — stuffing zeros at end-of-stream is standard behavior, and chunks_exact() already guarantees bounds for the packed decoders, so the OOB case can't happen there anyway.
2. Metadata parsing — a truncated field reading as 0 falls through to existing error handling (tag not found, invalid offset, etc). The targeted bounds checks in TiffEntry::new() and the IFD loop catch the cases where 0 would cause a downstream slice panic.

Unit tests verify the checked helpers return identical values to the originals for every valid position. The checked_add in the helpers also prevents a usize overflow panic when pos is near usize::MAX (caught by tests).

No performance impact

cargo asm confirms decode_16le produces identical assembly before and after. The entire release .rlib has zero panic_bounds_check calls — LLVM eliminates every bounds check, same as the original. Benchmarked with the built-in benchmark binary on DNG (LJPEG) and CR2 (LJPEG+Huffman) files — within run-to-run noise, no measurable difference.

Test plan

• checked_helpers_match_unchecked_for_valid_data — no silent data corruption
• checked_helpers_return_zero_on_oob — boundary, past-boundary, empty buffer
• checked_helpers_no_wraparound_on_huge_pos — usize::MAX doesn't wrap
• endian_methods_match_free_functions — Endian wrappers delegate correctly
• 3 original fuzzing panic reproducers (FUJIFILM, X3F, TIFF IFD count)
• Truncated TIFF, crafted IFD data offset, FUJIFILM at every length 8–107
• Empty, 1-byte, and random-noise inputs

[lilith]

Summary

• Convert byte-reading helpers to use checked_add + .get(), returning 0 on out-of-bounds instead of panicking — same function signatures, no caller changes
• Harden TIFF parser: TiffEntry::new() returns Result with bounds validation, makernote parser uses .get() for magic-byte comparisons, FUJIFILM/IFD entry count validated
• X3fDecoder::new() returns Result instead of .unwrap()
• 4 unit tests + 9 integration tests covering valid-data equivalence, OOB behavior, usize overflow, and truncated/crafted inputs

See #54 for the discussion and approach comparison.

Why returning 0 is safe

The helpers are called in two contexts:

1. Bit pumps / decode loops — stuffing zeros at end-of-stream is standard behavior, and chunks_exact() already guarantees bounds for the packed decoders, so the OOB case can't happen there anyway.
2. Metadata parsing — a truncated field reading as 0 falls through to existing error handling (tag not found, invalid offset, etc). The targeted bounds checks in TiffEntry::new() and the IFD loop catch the cases where 0 would cause a downstream slice panic.

Unit tests verify the checked helpers return identical values to the originals for every valid position. The checked_add in the helpers also prevents a usize overflow panic when pos is near usize::MAX (caught by tests).

No performance impact

cargo asm confirms decode_16le produces identical assembly before and after. The entire release .rlib has zero panic_bounds_check calls — LLVM eliminates every bounds check, same as the original. Benchmarked with the built-in benchmark binary on DNG (LJPEG) and CR2 (LJPEG+Huffman) files — within run-to-run noise, no measurable difference.

Test plan

• checked_helpers_match_unchecked_for_valid_data — no silent data corruption
• checked_helpers_return_zero_on_oob — boundary, past-boundary, empty buffer
• checked_helpers_no_wraparound_on_huge_pos — usize::MAX doesn't wrap
• endian_methods_match_free_functions — Endian wrappers delegate correctly
• 3 original fuzzing panic reproducers (FUJIFILM, X3F, TIFF IFD count)
• Truncated TIFF, crafted IFD data offset, FUJIFILM at every length 8–107
• Empty, 1-byte, and random-noise inputs

[lilith]

Summary

• Convert byte-reading helpers to use checked_add + .get(), returning 0 on out-of-bounds instead of panicking — same function signatures, no caller changes
• Harden TIFF parser: TiffEntry::new() returns Result with bounds validation, makernote parser uses .get() for magic-byte comparisons, FUJIFILM/IFD entry count validated
• X3fDecoder::new() returns Result instead of .unwrap()
• 4 unit tests + 9 integration tests covering valid-data equivalence, OOB behavior, usize overflow, and truncated/crafted inputs

See #54 for the discussion and approach comparison.

Why returning 0 is safe

The helpers are called in two contexts:

1. Bit pumps / decode loops — stuffing zeros at end-of-stream is standard behavior, and chunks_exact() already guarantees bounds for the packed decoders, so the OOB case can't happen there anyway.
2. Metadata parsing — a truncated field reading as 0 falls through to existing error handling (tag not found, invalid offset, etc). The targeted bounds checks in TiffEntry::new() and the IFD loop catch the cases where 0 would cause a downstream slice panic.

Unit tests verify the checked helpers return identical values to the originals for every valid position. The checked_add in the helpers also prevents a usize overflow panic when pos is near usize::MAX (caught by tests).

No performance impact

cargo asm confirms decode_16le produces identical assembly before and after. The entire release .rlib has zero panic_bounds_check calls — LLVM eliminates every bounds check, same as the original. Benchmarked with the built-in benchmark binary on DNG (LJPEG) and CR2 (LJPEG+Huffman) files — within run-to-run noise, no measurable difference.

Test plan

• checked_helpers_match_unchecked_for_valid_data — no silent data corruption
• checked_helpers_return_zero_on_oob — boundary, past-boundary, empty buffer
• checked_helpers_no_wraparound_on_huge_pos — usize::MAX doesn't wrap
• endian_methods_match_free_functions — Endian wrappers delegate correctly
• 3 original fuzzing panic reproducers (FUJIFILM, X3F, TIFF IFD count)
• Truncated TIFF, crafted IFD data offset, FUJIFILM at every length 8–107
• Empty, 1-byte, and random-noise inputs