chore: hardening

[jonasteuwen]

• Improved security (e.g. no arbitrary traversal in index files for MRXS, bound checks etc)

GitOrigin-RevId: 94d13f68c6d80d5b8a475d16271594533c9309de

[Copilot]

Pull request overview

Hardening-focused changes across readers/decoders and the tile writer to prevent out-of-bounds reads, integer overflows, and directory traversal when consuming untrusted slide metadata. The PR also removes several cache-related public APIs/tests/benchmarks, shifting the exposed surface area.

Changes:

• Add strict size/overflow checks to decoded-tile painting and BMP/TIFF decoding paths to prevent OOB reads from malformed inputs.
• Add a reusable path-containment helper (ResolveContainedPath) and apply it to OME-Zarr and MRXS to block directory traversal/symlink escapes.
• Clamp and validate attacker-controlled counts in iSyntax parsing to avoid fixed-array overruns.

Reviewed changes

Copilot reviewed 39 out of 39 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/python/cache_test.py	Removes non-hermetic cache tests requiring external slide input.
tests/meson.build	Adds path_utils_test; removes C-API cache test wiring.
src/runtime/tile_writer/paint_dispatch.cpp	Adds checked multiplication + buffer-length validation before tile sinks read from decoded buffers.
src/runtime/tile_writer_test.cpp	Adds tests asserting invalid tile geometry/buffer mismatches are rejected.
src/runtime/io/path_utils_test.cpp	New gtest coverage for path containment (.., absolute paths, symlinks, prefix siblings).
src/runtime/decoders/bmp_decoder.cpp	Prevents 32-bit row-stride wrap by computing stride in 64-bit and rejecting overflow.
src/runtime/decoders/bmp_decoder_test.cpp	Adds regression test for overflow-width BMP header.
src/readers/qptiff/metadata_parser.cpp	Replaces throwing stoull with from_chars parsing to avoid exceptions across C boundaries.
src/readers/omezarr/omezarr.cpp	Uses ResolveContainedPath to confine dataset paths to the store root.
src/readers/mrxs/mrxs_metadata_loader.cpp	Validates INI-referenced filenames stay within the slide directory.
src/readers/mrxs/mrxs_data_reader.cpp	Adds maximum-size and file-bounds checks before allocating/reading arbitrary records.
src/readers/isyntax/third_party/xml_semantics.cpp	Clamps attacker-controlled numsteps to prevent level array/shift misuse.
src/readers/isyntax/third_party/xml_parser.cpp	Bounds DPScannedImage count to avoid writing past fixed image array.
src/readers/isyntax/third_party/open.cpp	Validates parsed level_count is within supported bounds before geometry init.
src/python/fastslide.cpp	Removes from_file_path(cache=...) and multiple cache convenience APIs from Python binding.
src/python/_fastslide.pyi	Updates type stubs to match removed Python cache surface.
src/image_test.cpp	Adds test ensuring DataTypeFromSampleFormat preserves storage width.
src/core/tile_plan_test.cpp	Adds test ensuring output pixel format width never exceeds source type width.
src/c/slide_reader.cpp	Removes C API per-reader cache functions and cache stats plumbing.
src/c/registry.cpp	Removes C API “open with cache” and global cache control/stat functions.
src/c/cache_c_api_test.cpp	Deletes C-API cache correctness tests requiring external slide input.
rust/fastslide/src/registry.rs	Removes Rust wrapper functions for global cache control/stats.
rust/fastslide/src/reader.rs	Removes Rust per-reader cache APIs and cache stats type.
rust/fastslide/src/lib.rs	Removes re-exports and tests related to caching APIs.
rust/fastslide-sys/src/lib.rs	Removes FFI bindings for cache-related C APIs.
package/Dockerfile	Removes apt retry hardening snippet in packaging container.
meson.build	Removes fastslide_c_dep declaration used only for removed cache C-API tests.
include/fastslide/slide_options.h	Introduces cache-related dependency/options fields in a new options header.
include/fastslide/runtime/io/path_utils.h	Adds path containment helper for untrusted slide-provided paths.
include/fastslide/readers/simpletiff_decode_utils.h	Adds decoded-geometry vs buffer-size validation to prevent OOB reads.
include/fastslide/readers/isyntax/third_party/isyntax.h	Adds explicit max constants and applies them to fixed arrays.
include/fastslide/image.h	Preserves 8-bit signed storage width by mapping to kUInt8 instead of widening.
include/fastslide/core/tile_plan.h	Ensures signed types map to same-width unsigned output formats.
include/fastslide/c/slide_reader.h	Removes C API cache functions and cache stats struct from public header.
include/fastslide/c/registry.h	Removes C API functions for cached reader creation and global cache control.
docs/source/caching.rst	Updates caching docs to a dependency-injection model and removes C/Rust/Python cache sections.
BUILD.bazel	Adds runtime_path_utils target and path_utils_test; removes cache C-API test target.
benchmarks/cache_benchmark.cpp	Removes cache benchmark requiring external slide input.
.github/workflows/release.yml	Simplifies docker build step by removing retry loop.

Comments suppressed due to low confidence (5)

include/fastslide/slide_options.h:72

• DependencyBundle::tile_cache should point at the cache interface (runtime::ITileCache) rather than a non-existent TileCache type, so callers can pass LRUTileCache/custom caches consistently with the rest of the runtime API.

  /// @brief Optional tile cache for decoded tiles
  ///
  /// Readers can use this cache to store decoded tiles for faster access.
  /// If nullptr, readers should manage their own caching or disable caching.
  std::shared_ptr<TileCache> tile_cache;

docs/source/caching.rst:145

• ReaderRegistry::CreateReader currently takes an optional std::shared_ptr<ITileCache> (see include/fastslide/runtime/reader_registry.h), not a ReaderDependencies object. Update the snippet to pass the global cache directly, otherwise the documentation example won't compile.

   // Create reader with global cache (automatic injection)
   auto deps = fastslide::ReaderDependencies::WithGlobalCache();
   auto reader_or = registry.CreateReader("slide.mrxs", deps);

docs/source/caching.rst:192

• This section uses ReaderDependencies::WithCache(...), but the current C++ API for ReaderRegistry::CreateReader accepts the cache directly (std::shared_ptr<ITileCache>). As written, the example won't compile.

   // Inject via dependencies
   auto deps = fastslide::ReaderDependencies::WithCache(*cache_or);
   auto reader_or = registry.CreateReader("slide.mrxs", deps);

docs/source/caching.rst:215

• ReaderDependencies is referenced here, but there is no such type in the current codebase, and CreateReader does not accept an options/dependencies struct. If you want an explicit "disable caching" example with the current API, pass nullptr as the cache argument (equivalent to omitting it).

   // Option 2: Explicitly disable
   fastslide::ReaderDependencies deps;
   deps.enable_caching = false;
   auto reader_or = registry.CreateReader("slide.mrxs", deps);

include/fastslide/slide_options.h:66

• The example shows registry.CreateReader("slide.mrxs", options), but the current ReaderRegistry::CreateReader overload takes (filename, std::shared_ptr<ITileCache> cache); there is no overload that accepts SlideOpenOptions. As written, this example won't compile and may mislead API consumers.

/// SlideOpenOptions options;
/// options.dependencies = deps;
///
/// auto reader = registry.CreateReader("slide.mrxs", options);
/// @endcode

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.