chore: hardening

[jonasteuwen]

GitOrigin-RevId: fab6fcbae2626becb9ad5f107924bcae1e96fb34

[Copilot]

Pull request overview

Hardening-focused PR that adds bounds/containment validation around untrusted slide metadata and decoded buffers to prevent out-of-bounds reads and filesystem path traversal across multiple readers and the tile writer.

Changes:

• Add robust buffer-size / overflow checks in tile painting and TIFF/BMP decoding paths.
• Introduce ResolveContainedPath and use it to confine bundle-relative paths (OME-Zarr, MRXS) to the slide root.
• Add iSyntax fixed-array capacity bounds, safer XML parsing, and new regression tests for the above hardening.

Reviewed changes

Copilot reviewed 21 out of 22 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/meson.build	Registers the new path_utils_test in the Meson test suite.
src/runtime/tile_writer/paint_dispatch.cpp	Adds overflow-safe required-size calculation and rejects undersized tile buffers before paint sinks run.
src/runtime/tile_writer_test.cpp	Adds regression tests for rejecting zero-channel tiles and truncated tile buffers.
src/runtime/io/path_utils_test.cpp	New tests covering bundle containment rules (.. traversal, absolute paths, symlink escape, prefix siblings).
src/runtime/decoders/bmp_decoder.cpp	Computes BMP row stride in 64-bit and rejects widths that would overflow 32-bit stride math.
src/runtime/decoders/bmp_decoder_test.cpp	New regression test for row-stride overflow width.
src/readers/qptiff/metadata_parser.cpp	Replaces throwing stoull with non-throwing from_chars parsing to avoid exception escape across C boundaries.
src/readers/omezarr/omezarr.cpp	Validates datasets[].path stays within the store root before filesystem access.
src/readers/mrxs/mrxs_metadata_loader.cpp	Validates INI-referenced filenames are contained within the slide directory.
src/readers/mrxs/mrxs_data_reader.cpp	Adds max-size and file-bound checks to prevent oversized allocations / out-of-file reads.
src/readers/isyntax/third_party/xml_semantics.cpp	Clamps attacker-controlled level count before indexing/shifting.
src/readers/isyntax/third_party/xml_parser.cpp	Bounds the number of DPScannedImage objects to fixed array capacity.
src/readers/isyntax/third_party/open.cpp	Validates parsed level count is within supported range before using it.
src/image_test.cpp	Adds test ensuring DataTypeFromSampleFormat preserves storage width semantics.
src/core/tile_plan_test.cpp	Adds test ensuring output pixel format selection never widens relative to the source dtype.
package/versions.json	Re-formats JSON (no semantic change).
include/fastslide/runtime/io/path_utils.h	Introduces ResolveContainedPath helper implementing canonicalized containment enforcement.
include/fastslide/readers/simpletiff_decode_utils.h	Adds decoded-geometry overflow checks and ensures decoded buffer is large enough for declared geometry.
include/fastslide/readers/isyntax/third_party/isyntax.h	Defines ISYNTAX_MAX_LEVELS/IMAGES and uses them for fixed-capacity arrays.
include/fastslide/image.h	Ensures signed 8-bit pages map to 1-byte storage (kUInt8) rather than widening.
include/fastslide/core/tile_plan.h	Improves dtype→pixel-format mapping to avoid widening (esp. signed ints) and adds explanatory comments.
BUILD.bazel	Adds runtime_path_utils library and its test target; wires library into top-level deps.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.