yeptris 0.6.56.1-arm-linux-eabihf → 0.6.58.1-arm-linux-eabihf

data/vendor/libyeptris/src/include/yeptris/validate.h

@@ -0,0 +1,157 @@
+/* validate.h — the validation face (issue #882).
+ *
+ * Two checks over one engine pass:
+ *
+ *  1. SCHEMA-FAMILY validation (`yeptris_validate`): parse + validate
+ *     fused. Under YEPTRIS_SCHEMA_12_CORE the walk checks explicit-tag
+ *     consistency (spec 10.3 resolution) and mapping-key uniqueness
+ *     (spec 3.2.1.3: keys compare by canonical form — 0o13 and 0xB
+ *     are the same key). Under YEPTRIS_SCHEMA_12_JSON the spec 10.2
+ *     family applies: every PLAIN scalar must match a JSON production
+ *     (the table's `*` -> Error row), mapping keys must be strings,
+ *     non-JSON tags are rejected; core checks still run.
+ *
+ *  2. JSON SCHEMA validation (`yeptris_json_schema_validate`): the
+ *     schema arrives as bytes (parsed with the same engine), the
+ *     target against it — draft 2020-12 keyword subset (see the entry
+ *     comment). Unknown keywords are ignored, per 2020-12.
+ *
+ * Every diagnostic carries a JSON-pointer instance path ("/a/b/0" —
+ * ~0/~1 escaped), a YEPTRIS_DIAG_* code, a bounded expected/got
+ * detail, and the offending node's 1-based line/column (0 = unknown:
+ * scalars whose bytes the DOM owns in its arena have no input
+ * position; the path still identifies them exactly).
+ *
+ * Results are WHOLE REPORTS: one call, no per-diagnostic callback —
+ * the caller drains the flat array and frees the report once.
+ */
+#ifndef YEPTRIS_VALIDATE_H
+#define YEPTRIS_VALIDATE_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <yeptris/api.h>
+#include <yeptris/error.h>
+#include <yeptris/parse.h> /* YeptrisDocument, YeptrisSchema */
+#include <yeptris/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Diagnostic codes. Appending only — bindings hard-code the values
+ * (test_abi pins the head). */
+typedef enum {
+    YEPTRIS_DIAG_NONE = 0,
+    /* the schema-family walk */
+    YEPTRIS_DIAG_TAG_MISMATCH = 1,   /* explicit tag contradicts content */
+    YEPTRIS_DIAG_KEY_NOT_STRING = 2, /* json12: mapping key is not a string */
+    YEPTRIS_DIAG_NON_JSON_TYPE = 3,  /* json12: plain scalar matches no
+                                      * JSON production / carries a
+                                      * non-JSON tag (spec 10.2.2 Error) */
+    YEPTRIS_DIAG_DUPLICATE_KEY = 4,  /* equal keys in one mapping */
+    /* the JSON Schema walk */
+    YEPTRIS_DIAG_TYPE = 5,
+    YEPTRIS_DIAG_REQUIRED = 6,
+    YEPTRIS_DIAG_ENUM = 7,
+    YEPTRIS_DIAG_CONST = 8,
+    YEPTRIS_DIAG_PATTERN = 9,
+    YEPTRIS_DIAG_MINIMUM = 10,
+    YEPTRIS_DIAG_MAXIMUM = 11,
+    YEPTRIS_DIAG_EXCLUSIVE_MINIMUM = 12,
+    YEPTRIS_DIAG_EXCLUSIVE_MAXIMUM = 13,
+    YEPTRIS_DIAG_MIN_LENGTH = 14,
+    YEPTRIS_DIAG_MAX_LENGTH = 15,
+    YEPTRIS_DIAG_MIN_ITEMS = 16,
+    YEPTRIS_DIAG_MAX_ITEMS = 17,
+    YEPTRIS_DIAG_UNIQUE_ITEMS = 18,
+    YEPTRIS_DIAG_ADDITIONAL_PROPERTY = 19,
+    YEPTRIS_DIAG_ANY_OF = 20,
+    YEPTRIS_DIAG_ONE_OF = 21,
+    YEPTRIS_DIAG_NOT = 22,
+    YEPTRIS_DIAG_REF = 23,          /* $ref unresolvable / chain too deep */
+    YEPTRIS_DIAG_FALSE_SCHEMA = 24, /* the schema is `false` here */
+    YEPTRIS_DIAG_DEPTH = 25,        /* recursion guard tripped */
+    YEPTRIS_DIAG_LIMIT = 26,        /* report truncated (the sentinel
+                                     * rides the LAST slot; more
+                                     * diagnostics were dropped) */
+} YeptrisDiagCode;
+
+/* Bounded diagnostic text; always NUL-terminated (over-long paths and
+ * details truncate — the same discipline as the error channel). */
+#define YEPTRIS_DIAG_PATH_MAX 256
+#define YEPTRIS_DIAG_DETAIL_MAX 128
+
+typedef struct yeptris_diagnostic {
+    uint32_t code; /* YeptrisDiagCode */
+    uint32_t line; /* 1-based; 0 = unknown */
+    uint32_t col;  /* 1-based; 0 = unknown */
+    uint32_t offset;
+    char path[YEPTRIS_DIAG_PATH_MAX];
+    char detail[YEPTRIS_DIAG_DETAIL_MAX];
+} yeptris_diagnostic;
+YEPTRIS_CT_ASSERT(sizeof(yeptris_diagnostic) ==
+                  16 + YEPTRIS_DIAG_PATH_MAX + YEPTRIS_DIAG_DETAIL_MAX);
+
+/* The diagnostics list. Opaque; free it with
+ * yeptris_validate_report_free (one call, everything). */
+typedef struct yeptris_validate_report yeptris_validate_report;
+
+/* Diagnostic count (0 = the document is valid). */
+YEPTRIS_API size_t yeptris_validate_report_count(const yeptris_validate_report* report);
+
+/* Diagnostic i (0-based); NULL out of range. Memory: borrowed from the
+ * report — valid until yeptris_validate_report_free. */
+YEPTRIS_API const yeptris_diagnostic*
+yeptris_validate_report_at(const yeptris_validate_report* report, size_t index);
+
+YEPTRIS_API void yeptris_validate_report_free(yeptris_validate_report* report);
+
+/* Parses `buf` (the same front door as yeptris_parse_ex: encodings,
+ * BOM, NEL normalization) and validates every document of the stream
+ * against `schema`. Paths are root-relative per document.
+ *
+ * Status: YEPTRIS_OK (valid; *out is a report — possibly with zero
+ * diagnostics for an empty stream); YEPTRIS_ERROR_SCHEMA (invalid:
+ * drain *out); YEPTRIS_ERROR_PARSE / DEPTH / ENCODING / MEMORY (the
+ * parse itself failed; *out stays NULL); YEPTRIS_ERROR_ARG.
+ *
+ * Memory: the caller owns *out; free it with
+ * yeptris_validate_report_free. */
+YEPTRIS_API YeptrisStatus yeptris_validate(const char* buf, size_t len, YeptrisSchema schema,
+                                           yeptris_validate_report** out);
+
+/* Validates an already-parsed document (or stream). The document is
+ * not modified; the report borrows nothing from it. */
+YEPTRIS_API YeptrisStatus yeptris_validate_document(YeptrisDocument doc, YeptrisSchema schema,
+                                                    yeptris_validate_report** out);
+
+/* JSON Schema draft 2020-12 subset (#882 slice 2). `schema` is parsed
+ * with the same engine (JSON is YAML flow); document 0 of the stream
+ * is the schema. Keyword subset: type, enum, const, pattern, minimum/
+ * maximum/exclusiveMinimum/exclusiveMaximum (numeric, 2020-12 form),
+ * minLength/maxLength (code points), minItems/maxItems, uniqueItems,
+ * items (+ prefixItems; the draft-07 array form rides as prefixItems),
+ * properties, required, additionalProperties (bool or schema),
+ * allOf/anyOf/oneOf/not, $ref (LOCAL "#/..." pointers only — $defs and
+ * definitions both resolve). Boolean schemas (`true`/`false`) apply.
+ * Unknown keywords and known keywords with unreadable values are
+ * ignored (2020-12). Instance types ride the core-schema resolution
+ * (the YAML->JSON data model): "y" is boolean, 1.0 is integer.
+ *
+ * Status: as yeptris_validate, plus YEPTRIS_ERROR_ARG when the schema
+ * bytes hold no document, and YEPTRIS_ERROR_PARSE when they do not
+ * parse. A $ref that resolves nowhere is a DIAG_REF diagnostic, not a
+ * status. Recursion is depth-guarded (the engine's guard): a
+ * self-referential $ref over a deep or cyclic chain reports DIAG_DEPTH
+ * / DIAG_REF — never a crash. */
+YEPTRIS_API YeptrisStatus yeptris_json_schema_validate(const char* schema, size_t schema_len,
+                                                       const char* buf, size_t len,
+                                                       yeptris_validate_report** out);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* YEPTRIS_VALIDATE_H */

data/vendor/libyeptris/src/include/yeptris.h

@@ -18,6 +18,7 @@
 #include <yeptris/parse.h>
 #include <yeptris/resolve.h>
 #include <yeptris/types.h>
+#include <yeptris/validate.h>
 #include <yeptris/version.h>
 
 #endif /* YEPTRIS_H */

data/vendor/libyeptris/src/yeptris/dom/dom.c

@@ -26,16 +26,35 @@ static int cap_arena(const yep_dom* d, uint32_t need) {
     return d->input_len == 0 || (size_t)(d->str_len + need) <= d->input_len * 128 + (1u << 20);
 }
 
+/* Doubling with the uint32 ceiling (the audit's wrap finding): the old
+ * `while (cap < target) cap *= 2` wrapped to 0 and span forever once a
+ * cap crossed 2^31 with a target above it. A cap that cannot double
+ * inside uint32 — or a target past the 32-bit space at all — is an
+ * alloc failure, never a wrapped capacity. */
+static int dom_cap_next(uint32_t cap, size_t target, uint32_t* out) {
+    if (target > UINT32_MAX) {
+        return 0;
+    }
+    while (cap < target) {
+        if (cap > UINT32_MAX / 2) {
+            return 0;
+        }
+        cap *= 2;
+    }
+    *out = cap;
+    return 1;
+}
+
 int dom_grow_nodes(yep_dom* d, uint32_t need) {
-    if (d->ncount + need <= d->ncap) {
+    if ((size_t)d->ncount + need <= d->ncap) {
         return 1;
     }
     if (!cap_nodes(d)) {
         return 0;
     }
-    uint32_t ncap = d->ncap ? d->ncap * 2 : 64;
-    while (ncap < d->ncount + need) {
-        ncap *= 2;
+    uint32_t ncap;
+    if (!dom_cap_next(d->ncap ? d->ncap : 64, (size_t)d->ncount + need, &ncap)) {
+        return 0;
     }
     yep_dnode* nd = yep_pool_alloc(d->pool, (size_t)ncap * sizeof(yep_dnode), 16);
     if (nd == NULL) {
@@ -50,15 +69,15 @@ int dom_grow_nodes(yep_dom* d, uint32_t need) {
 }
 
 int dom_grow_docs(yep_dom* d, uint32_t need) {
-    if (d->dcount + need <= d->dcap) {
+    if ((size_t)d->dcount + need <= d->dcap) {
         return 1;
     }
     if (d->input_len != 0 && (size_t)d->dcount > d->input_len / 2 + 16) {
         return 0;
     }
-    uint32_t ncap = d->dcap ? d->dcap * 2 : 16;
-    while (ncap < d->dcount + need) {
-        ncap *= 2;
+    uint32_t ncap;
+    if (!dom_cap_next(d->dcap ? d->dcap : 16, (size_t)d->dcount + need, &ncap)) {
+        return 0;
     }
     uint32_t* nd = yep_pool_alloc(d->pool, (size_t)ncap * sizeof(uint32_t), 16);
     if (nd == NULL) {
@@ -75,15 +94,15 @@ int dom_grow_docs(yep_dom* d, uint32_t need) {
 /* Doubles the arena until cap bytes fit; 0 on OOM. Offsets stored in
  * nodes stay valid across the move. */
 static int str_grow(yep_dom* d, uint32_t need) {
-    if (d->str_len + need <= d->str_cap) {
+    if ((size_t)d->str_len + need <= d->str_cap) {
         return 1;
     }
     if (!cap_arena(d, need)) {
         return 0;
     }
-    uint32_t cap = d->str_cap ? d->str_cap : 256;
-    while (cap < d->str_len + need) {
-        cap *= 2;
+    uint32_t cap;
+    if (!dom_cap_next(d->str_cap ? d->str_cap : 256, (size_t)d->str_len + need, &cap)) {
+        return 0;
     }
     char* ns = yep_alloc(d->sys, cap);
     if (ns == NULL) {
@@ -100,8 +119,15 @@ static int str_grow(yep_dom* d, uint32_t need) {
 
 yep_sview yep_dom_str_put(yep_dom* d, const char* p, uint32_t len) {
     yep_sview sv = {YEP_SV_INPUT, 0}; /* empty: arena offset 0 */
-    if (len == 0 || !str_grow(d, len)) {
-        return sv; /* len 0 or OOM: empty view */
+    if (len == 0) {
+        return sv;
+    }
+    if (!str_grow(d, len)) {
+        /* OOM: an empty view here would silently corrupt the document
+         * (the value reads as ""). Record it; dom_place/dom_open_node
+         * fail the parse with the memory status. */
+        d->oom = 1;
+        return sv;
     }
     memcpy(d->str + d->str_len, p, len);
     sv.off = YEP_SV_INPUT | d->str_len;
@@ -172,6 +198,11 @@ uint32_t dom_open_node(yep_dom* d, uint8_t kind, const yep_view* tag, const yep_
     n->kind = kind;
     n->tag = dom_str_in(d, tag, 0);
     n->anchor = dom_str_in(d, anchor, anchor_borrowed);
+    if (d->oom) {
+        /* the tag/anchor arena write failed: refuse the node (the slot
+         * is uncommitted — the next open re-initializes it) */
+        return UINT32_MAX;
+    }
     n->style = style;
     n->implicit = implicit;
     n->flow = flow;
@@ -213,8 +244,8 @@ static int dom_anchor_set(yep_dom* d, uint32_t ordinal, uint32_t node) {
                 cap = sized;
             }
         }
-        while (cap < ordinal) {
-            cap *= 2;
+        if (!dom_cap_next(cap, ordinal, &cap)) {
+            return -1; /* the wrap-checked doubling (audit round 5) */
         }
         uint32_t* na = yep_alloc(d->sys, cap * sizeof(*na));
         if (na == NULL) {
@@ -271,9 +302,9 @@ static int dom_mut_grow(yep_dom* d, uint32_t need) {
     if (need <= d->mut_tbl_cap) {
         return 1;
     }
-    uint32_t cap = d->mut_tbl_cap ? d->mut_tbl_cap : 64;
-    while (cap < need) {
-        cap *= 2;
+    uint32_t cap;
+    if (!dom_cap_next(d->mut_tbl_cap ? d->mut_tbl_cap : 64, need, &cap)) {
+        return 0; /* the wrap-checked doubling (audit round 5) */
     }
     uint8_t* na = yep_alloc(d->sys, (size_t)cap / 8 + 1);
     uint16_t* nd = yep_alloc(d->sys, (size_t)cap * sizeof(uint16_t));
@@ -335,8 +366,13 @@ void dom_mut_set_depth(yep_dom* d, uint32_t id, uint16_t depth) {
 }
 
 /* Places a completed node: value for a pending key, child of the top
- * collection, or document root. */
+ * collection, or document root. Every builder path ends here, so it is
+ * also the OOM choke: an arena write that failed (d->oom) must fail
+ * the node, never leave a silently-empty value in the tree. */
 int dom_place(yep_dom* d, uint32_t id) {
+    if (d->oom) {
+        return -1;
+    }
     if (d->depth == 0) {
         if (!dom_grow_docs(d, 1)) {
             return -1;

data/vendor/libyeptris/src/yeptris/dom/dom.h

@@ -119,6 +119,11 @@ typedef struct yep_dom {
      * OFFSETS into it, so growth never dangles (dom_str_put) */
     char* str;
     uint32_t str_len, str_cap;
+    /* an arena write failed (str_put under OOM): the value would have
+     * silently become the empty view — doc corruption. Sticky; every
+     * builder path checks it at dom_place/dom_open_node and fails the
+     * parse with the memory status. */
+    int oom;
     const char* input_base; /* borrowed parse input (offset base) */
     /* handle arena: thread-safe (atomic bump) — query APIs allocate
      * YeptrisNode wrappers here, so read-only document sharing across

data/vendor/libyeptris/src/yeptris/events/iterparse.c

@@ -11,12 +11,20 @@
 
 #include "../../include/yeptris/events.h"
 #include "../common/simd_text.h"
+#include "../encoding/encoding.h"
+#include "../memory/allocator.h"
 #include "../parse/engine.h"
 #include "capture.h"
 
 typedef struct {
     yep_rec_store* store;
     int doc_ends; /* DOCUMENT_END events seen this run */
+    int oom;      /* the capture failed: yep_rec_on_event returned
+                   * nonzero — the engine's rc (-2) is shared with the
+                   * normal document-abort, so without this bit an OOM
+                   * was indistinguishable from doc-complete and the
+                   * final event vanished silently (the audit's
+                   * finding) */
 } yep_iter_sink;
 
 static int iter_on_event(void* ctx, const yep_event* ev) {
@@ -31,6 +39,7 @@ static int iter_on_event(void* ctx, const yep_event* ev) {
     }
     int rc = yep_rec_on_event(s->store, ev);
     if (rc != 0) {
+        s->oom = 1;
         return rc;
     }
     if (s->doc_ends >= 1) {
@@ -44,6 +53,11 @@ struct yeptris_iterparse {
     size_t len;
     size_t cursor;
     int done;
+    int gated;            /* the encoding front-end ran once: after it, buf
+                           * indexes the space every engine run's pos lives
+                           * in (the resume arithmetic requires it) */
+    unsigned char* owned; /* UTF-16/32 transcode output (buf moved) */
+    char* norm;           /* NEL/LS/PS-normalized copy (buf moved) */
     int emitted_stream_start;
     int pending_stream_end; /* deliver a final lone STREAM_END slice */
     YeptrisStatus status;
@@ -76,6 +90,55 @@ YEPTRIS_API const YeptrisEvent* yeptris_iterparse_next(YeptrisIterparse it, size
         return NULL;
     }
     for (;;) {
+        /* the encoding front-end, ONCE (the yep_engine_run law): the
+         * resume arithmetic below adds the engine's pos to it->cursor,
+         * and pos lives in the buffer space the RUN parsed — never the
+         * raw bytes. The front-end's consumed prefix broke that twice:
+         * the BOM it strips (pos cannot see it, so a BOM'd stream
+         * re-parsed the previous document's tail), and the UTF-16/32
+         * transcode (pos counts UTF-8 bytes, cursor counts raw ones —
+         * slices corrupted). The NEL/LS/PS break normalizer inside the
+         * run shifts pos the same way, so the gate owns both: encode
+         * to UTF-8 and normalize here, move buf, and the spaces agree. */
+        if (!it->gated) {
+            it->gated = 1;
+            const yep_allocator* sys = yep_system_allocator();
+            yep_encoding enc = YEP_ENC_UNKNOWN;
+            size_t bom = yep_bom_sniff((const unsigned char*)it->buf, it->len, &enc);
+            if (enc == YEP_ENC_UTF16LE || enc == YEP_ENC_UTF16BE || enc == YEP_ENC_UTF32LE ||
+                enc == YEP_ENC_UTF32BE) {
+                size_t tlen = 0;
+                size_t terr = 0;
+                int rc = yep_transcode_to_utf8(sys, enc, (const unsigned char*)it->buf + bom,
+                                               it->len - bom, &it->owned, &tlen, &terr);
+                if (rc != 0) {
+                    it->done = 1;
+                    it->status = YEPTRIS_ERROR_ENCODING;
+                    it->err_line = 1;
+                    it->err_col = 1;
+                    return NULL;
+                }
+                /* the copy IS the post-gate buffer: it opens at the
+                 * first content byte (the mark never entered it), so
+                 * cursor restarts at zero — keeping `bom` here skipped
+                 * the copy's first unit and corrupted the first slice */
+                it->buf = (const char*)it->owned;
+                it->len = tlen;
+                it->cursor = 0;
+            } else {
+                it->cursor = bom; /* the mark is the front-end's prefix */
+            }
+            size_t nlen = 0;
+            int kept_raw = 0;
+            char* norm = yep_engine_normalize_breaks(sys, it->buf + it->cursor,
+                                                     it->len - it->cursor, &nlen, &kept_raw);
+            if (norm != NULL) {
+                it->norm = norm;
+                it->buf = norm;
+                it->len = nlen;
+                it->cursor = 0; /* the copy starts at its own zero */
+            }
+        }
         if (it->done && it->pending_stream_end && it->next >= it->store.n) {
             it->pending_stream_end = 0;
             if (!it->emitted_stream_start) {
@@ -133,7 +196,7 @@ YEPTRIS_API const YeptrisEvent* yeptris_iterparse_next(YeptrisIterparse it, size
          * document's start on the resumed run */
         yep_rec_reset(&it->store);
         it->next = 0;
-        yep_iter_sink s = {&it->store, 0};
+        yep_iter_sink s = {&it->store, 0, 0};
         yep_engine* eng = yep_engine_create(yep_system_allocator());
         if (eng == NULL) {
             it->done = 1;
@@ -153,15 +216,39 @@ YEPTRIS_API const YeptrisEvent* yeptris_iterparse_next(YeptrisIterparse it, size
         yep_engine_prepare(eng, &pst);
         int rc = yep_engine_run(eng, it->buf + it->cursor, it->len - it->cursor, &sink);
         size_t pos = yep_engine_pos(eng);
-        const yep_error* err = yep_engine_error(eng);
-        if (rc == -1 && err != NULL) {
-            it->err_line = err->line;
-            it->err_col = err->col;
+        /* the error slot lives inside the engine and destroy munmaps it
+         * (glibc serves the ~260KB engine with mmap): copy the verdict
+         * out BEFORE the free */
+        yep_err_code err_code = YEP_ERR_NONE;
+        uint32_t err_line = 0, err_col = 0;
+        {
+            const yep_error* err = yep_engine_error(eng);
+            if (err != NULL) {
+                err_code = err->code;
+                err_line = err->line;
+                err_col = err->col;
+            }
         }
         yep_engine_destroy(eng);
-        if (rc == -1) {
+        /* A failed run with a SET channel is a parse-class error and the
+         * CODE picks the public status; a failed run with a CLEAN
+         * channel is the capture sink dying — memory, never a parse
+         * error, and never a silent stream end (the old code fell into
+         * the doc-complete arm on rc == -2 and the final event
+         * vanished). The abort (rc == -2 without s.oom) stays the
+         * normal per-document completion. */
+        int failed = rc == -1 || s.oom;
+        if (failed) {
             it->done = 1;
-            it->status = err != NULL ? YEPTRIS_ERROR_PARSE : YEPTRIS_ERROR_MEMORY;
+            if (err_code != YEP_ERR_NONE) {
+                it->err_line = err_line;
+                it->err_col = err_col;
+                it->status = err_code == YEP_ERR_MEMORY     ? YEPTRIS_ERROR_MEMORY
+                             : err_code == YEP_ERR_ENCODING ? YEPTRIS_ERROR_ENCODING
+                                                            : YEPTRIS_ERROR_PARSE;
+            } else {
+                it->status = YEPTRIS_ERROR_MEMORY;
+            }
             if (it->store.n == 0) {
                 if (!it->emitted_stream_start) {
                     /* the engine emitted +STR before failing: match it */
@@ -202,6 +289,9 @@ YEPTRIS_API void yeptris_iterparse_free(YeptrisIterparse it) {
     if (it == NULL) {
         return;
     }
+    const yep_allocator* sys = yep_system_allocator();
+    yep_free(sys, it->owned);
+    yep_free(sys, it->norm);
     yep_rec_free(&it->store);
     free(it->mat);
     free(it);

data/vendor/libyeptris/src/yeptris/events/pull.c

@@ -44,13 +44,33 @@ YEPTRIS_API YeptrisPullParser yeptris_pull_new(const char* buf, size_t len) {
     yep_text_active()->scan_stats(buf, len, &pst);
     yep_engine_prepare(eng, &pst);
     int rc = yep_engine_run(eng, buf, len, &sink);
-    const yep_error* err = yep_engine_error(eng);
-    if (err != NULL && rc != 0) {
-        p->err_line = err->line;
-        p->err_col = err->col;
+    /* the error slot lives INSIDE the engine, and the engine is a
+     * ~260KB allocation glibc serves with mmap — destroy munmaps it,
+     * so the slot's verdict must be copied out BEFORE destroy (the
+     * round-5 CI segfaulted reading err->code after the free). */
+    yep_err_code err_code = YEP_ERR_NONE;
+    uint32_t err_line = 0, err_col = 0;
+    {
+        const yep_error* err = yep_engine_error(eng);
+        if (err != NULL) {
+            err_code = err->code;
+            err_line = err->line;
+            err_col = err->col;
+        }
     }
     yep_engine_destroy(eng);
-    p->status = rc == 0 ? YEPTRIS_OK : YEPTRIS_ERROR_PARSE;
+    /* the error CODE decides the public status — the parse route's law
+     * (the recorder twin carries the full comment). A clean channel
+     * under a failed run is the capture sink failing: memory. */
+    if (rc != 0 && err_code != YEP_ERR_NONE) {
+        p->err_line = err_line;
+        p->err_col = err_col;
+        p->status = err_code == YEP_ERR_MEMORY     ? YEPTRIS_ERROR_MEMORY
+                    : err_code == YEP_ERR_ENCODING ? YEPTRIS_ERROR_ENCODING
+                                                   : YEPTRIS_ERROR_PARSE;
+    } else {
+        p->status = rc == 0 ? YEPTRIS_OK : YEPTRIS_ERROR_MEMORY;
+    }
     return p;
 }
 

data/vendor/libyeptris/src/yeptris/events/push.c

@@ -61,6 +61,12 @@ static int push_on_event(void* ctx, const yep_event* ev) {
     e.flow = ev->flow;
     e.line = ev->line;
     e.col = ev->col;
+    /* the cross-model identity law (#179, test_event_marks): push,
+     * pull and the recorder emit identical mark data — dropping the
+     * end marks here made the push route's events half-marked where
+     * pull/recorder carried all four fields */
+    e.end_line = ev->end_line;
+    e.end_col = ev->end_col;
     e.value = ev->value.len > 0 ? (const char*)ev->value.p : NULL;
     e.value_len = ev->value.len;
     e.anchor = ev->anchor.len > 0 ? (const char*)ev->anchor.p : NULL;
@@ -95,10 +101,26 @@ YEPTRIS_API YeptrisStatus yeptris_push_parse(const char* buf, size_t len, yeptri
     yep_text_active()->scan_stats(buf, len, &pst);
     yep_engine_prepare(eng, &pst);
     int rc = yep_engine_run(eng, buf, len, &sink);
+    /* the error slot lives inside the engine and destroy munmaps it
+     * (glibc serves the ~260KB engine with mmap): copy the verdict out
+     * BEFORE the free — reading err->code after destroy segfaulted the
+     * round-5 CI */
+    yep_err_code err_code = YEP_ERR_NONE;
+    {
+        const yep_error* err = yep_engine_error(eng);
+        if (err != NULL) {
+            err_code = err->code;
+        }
+    }
     yep_engine_destroy(eng);
     if (rc == 0) {
         return YEPTRIS_OK;
     }
-    /* -2: the callback aborted — reported as a parse stop, not a bug */
+    /* the engine's own memory failures report MEMORY (the parse route's
+     * law); the callback abort keeps its documented contract — a parse
+     * stop, clean channel */
+    if (err_code == YEP_ERR_MEMORY) {
+        return YEPTRIS_ERROR_MEMORY;
+    }
     return YEPTRIS_ERROR_PARSE;
 }

data/vendor/libyeptris/src/yeptris/events/recorder.c

@@ -37,6 +37,23 @@ YEPTRIS_API YeptrisRecorder yeptris_recorder_new_ex(YeptrisSchema schema) {
     return r;
 }
 
+/* The engine's error code decides the public status — the parse
+ * route's law (parse.c maps YEP_ERR_* to the pinned codes). A clean
+ * channel means the SINK failed: the capture ran out of memory, the
+ * bytes never were a parse error. The MEMORY arm: the engine's own
+ * allocation failures (e_fail(YEP_ERR_MEMORY)) used to read as a parse
+ * error here — yep_engine_error always returns the slot, so the old
+ * `err != NULL` discriminator could never fire (the audit's finding). */
+static YeptrisStatus rec_status_from_err(const yep_error* err) {
+    if (err == NULL || err->code == YEP_ERR_NONE || err->code == YEP_ERR_MEMORY) {
+        return YEPTRIS_ERROR_MEMORY;
+    }
+    if (err->code == YEP_ERR_ENCODING) {
+        return YEPTRIS_ERROR_ENCODING;
+    }
+    return YEPTRIS_ERROR_PARSE;
+}
+
 YEPTRIS_API YeptrisStatus yeptris_recorder_feed(YeptrisRecorder rec, const char* chunk, size_t len,
                                                 int final) {
     if (rec == NULL || (chunk == NULL && len != 0)) {
@@ -71,15 +88,11 @@ YEPTRIS_API YeptrisStatus yeptris_recorder_feed(YeptrisRecorder rec, const char*
     int rc = yep_engine_step(rec->eng, chunk, len, final, &sink);
     if (rc != 0) {
         const yep_error* err = yep_engine_error(rec->eng);
-        if (err != NULL) {
+        if (err != NULL && err->code != YEP_ERR_NONE) {
             rec->err_line = err->line;
             rec->err_col = err->col;
-            rec->status = YEPTRIS_ERROR_PARSE;
-        } else {
-            /* a clean error channel means the SINK failed: the capture
-             * ran out of memory, the bytes never were a parse error */
-            rec->status = YEPTRIS_ERROR_MEMORY;
         }
+        rec->status = rec_status_from_err(err);
         rec->final_fed = 1; /* a failed feed kills the stream */
         return rec->status;
     }
@@ -107,6 +120,20 @@ YEPTRIS_API const char* yeptris_recorder_arena(YeptrisRecorder rec, size_t* len)
     return rec->store.arena;
 }
 
+YEPTRIS_API YeptrisStatus yeptris_recorder_status(const YeptrisRecorder rec, uint32_t* line,
+                                                  uint32_t* col) {
+    if (rec == NULL) {
+        return YEPTRIS_ERROR_ARG;
+    }
+    if (line != NULL) {
+        *line = rec->err_line;
+    }
+    if (col != NULL) {
+        *col = rec->err_col;
+    }
+    return rec->status;
+}
+
 YEPTRIS_API void yeptris_recorder_free(YeptrisRecorder rec) {
     if (rec == NULL) {
         return;

data/vendor/libyeptris/src/yeptris/memory/arena.c

@@ -98,7 +98,15 @@ void* yep_arena_alloc(yep_arena* arena, size_t size, size_t align) {
     uintptr_t base = (uintptr_t)b + sizeof(yep_arena_block);
     uintptr_t start = yep_round_up(base + b->used, align);
 
-    if (start + size > base + b->size) {
+    /* the fit test in subtraction form (the audit's finding): the old
+     * `start + size > base + b->size` wraps when size rides past the
+     * pointer space and the request "fits". The limit-first clause
+     * covers the round_up overshoot — start can sit up to align-1
+     * bytes past the limit, where `limit - start` would underflow — so
+     * both comparisons are wrap-free without leaning on the
+     * hostile-size guard above. */
+    uintptr_t limit = base + b->size;
+    if (start >= limit || size > limit - start) {
         /* Amortized doubling: each new block is at least twice the last,
          * unless the request itself is larger. */
         size_t payload = arena->last_block_size * 2;

data/vendor/libyeptris/src/yeptris/memory/pool.c

@@ -64,7 +64,11 @@ void* yep_pool_alloc(yep_pool* pool, size_t size, size_t align) {
     uintptr_t base = (uintptr_t)b + sizeof(yep_block);
     uintptr_t start = yep_round_up(base + b->used, align);
 
-    if (start + size > base + b->size) {
+    /* the fit test in subtraction form — the arena twin carries the
+     * full comment (wrap-free comparisons, round_up overshoot covered
+     * by the limit-first clause) */
+    uintptr_t limit = base + b->size;
+    if (start >= limit || size > limit - start) {
         /* Dedicated-or-default new block, sized so the aligned request
          * always fits (malloc returns at least 16-byte-aligned memory, so
          * the correction is < align). */