@zigc/lib 0.16.0 → 0.17.0-dev.135

package/std/c.zig

@@ -3260,8 +3260,8 @@ pub const Sigaction = switch (native_os) {
 
         /// signal handler
         handler: extern union {
-            handler: handler_fn,
-            sigaction: sigaction_fn,
+            handler: ?handler_fn,
+            sigaction: ?sigaction_fn,
         },
 
         /// signal mask to apply
@@ -7898,6 +7898,20 @@ pub const Stat = switch (native_os) {
     else => void,
 };
 
+pub const pthread_spinlock_t = switch (native_os) {
+    .openbsd => openbsd.pthread_spinlock_t,
+    .freebsd => extern struct {
+        inner: ?*anyopaque = null,
+    },
+    .netbsd => extern struct {
+        pts_magic: c_uint,
+        spin: pthread_spin_t,
+        pts_flags: c_int,
+    },
+    .windows => isize,
+    else => c_int,
+};
+
 pub const pthread_mutex_t = switch (native_os) {
     .linux => extern struct {
         data: [data_len]u8 align(@alignOf(usize)) = [_]u8{0} ** data_len,
@@ -10956,6 +10970,19 @@ pub extern "c" fn dn_expand(
     length: c_int,
 ) c_int;
 
+pub const PTHREAD_PROCESS_PRIVATE: c_int = if (native_os.isDarwin())
+    2
+else
+    0;
+
+pub const PTHREAD_PROCESS_SHARED: c_int = 1;
+
+pub extern "c" fn pthread_spin_init(spin: *pthread_spinlock_t, pshared: c_int) c_int;
+pub extern "c" fn pthread_spin_lock(spin: *pthread_spinlock_t) c_int;
+pub extern "c" fn pthread_spin_unlock(spin: *pthread_spinlock_t) c_int;
+pub extern "c" fn pthread_spin_trylock(spin: *pthread_spinlock_t) c_int;
+pub extern "c" fn pthread_spin_destroy(spin: *pthread_spinlock_t) c_int;
+
 pub const PTHREAD_MUTEX_INITIALIZER: pthread_mutex_t = .{};
 pub extern "c" fn pthread_mutex_lock(mutex: *pthread_mutex_t) E;
 pub extern "c" fn pthread_mutex_unlock(mutex: *pthread_mutex_t) E;
@@ -11102,6 +11129,64 @@ pub const ioctl = switch (native_os) {
     else => private.ioctl,
 };
 
+pub extern "c" fn bzero(s: *anyopaque, n: usize) void;
+
+pub extern "c" fn swab(noalias from: *const anyopaque, noalias to: *anyopaque, n: isize) void;
+
+pub extern "c" fn strncmp(a: [*:0]const c_char, b: [*:0]const c_char, max: usize) c_int;
+pub extern "c" fn strcasecmp(a: [*:0]const c_char, b: [*:0]const c_char) c_int;
+pub extern "c" fn strncasecmp(a: [*:0]const c_char, b: [*:0]const c_char, max: usize) c_int;
+pub extern "c" fn strdup(s: [*:0]const c_char) ?[*:0]c_char;
+pub extern "c" fn strndup(s: [*:0]const c_char, n: usize) ?[*:0]c_char;
+pub extern "c" fn wcsdup(s: [*:0]const wchar_t) ?[*:0]wchar_t;
+
+pub extern "c" fn ffs(i: c_int) c_int;
+pub extern "c" fn ffsl(i: c_long) c_long;
+pub extern "c" fn ffsll(i: c_longlong) c_longlong;
+
+pub extern "c" fn erand48(xsubi: *[3]c_ushort) f64;
+pub extern "c" fn jrand48(xsubi: *[3]c_ushort) c_long;
+pub extern "c" fn nrand48(xsubi: *[3]c_ushort) c_long;
+
+pub extern "c" fn insque(element: *anyopaque, pred: ?*anyopaque) void;
+pub extern "c" fn remque(element: *anyopaque) void;
+
+pub extern "c" fn imaxabs(a: intmax_t) intmax_t;
+pub extern "c" fn imaxdiv(a: intmax_t, b: intmax_t) imaxdiv_t;
+
+pub extern "c" fn abs(a: c_int) c_int;
+pub extern "c" fn labs(a: c_long) c_long;
+pub extern "c" fn llabs(a: c_longlong) c_longlong;
+
+pub extern "c" fn div(a: c_int, b: c_int) div_t;
+pub extern "c" fn ldiv(a: c_long, b: c_long) ldiv_t;
+pub extern "c" fn lldiv(a: c_longlong, b: c_longlong) lldiv_t;
+
+pub extern "c" fn atoi(str: [*:0]const c_char) c_int;
+pub extern "c" fn atol(str: [*:0]const c_char) c_long;
+pub extern "c" fn atoll(str: [*:0]const c_char) c_longlong;
+
+pub extern "c" fn bsearch(
+    key: *const anyopaque,
+    base: *const anyopaque,
+    n: usize,
+    size: usize,
+    compare: *const fn (a: *const anyopaque, b: *const anyopaque) callconv(.c) c_int,
+) ?*anyopaque;
+
+// Math
+pub extern "c" fn atan(x: f64) f64;
+pub extern "c" fn copysign(x: f64, y: f64) f64;
+pub extern "c" fn fdim(x: f64, y: f64) f64;
+pub extern "c" fn frexp(x: f64, e: *c_int) f64;
+pub extern "c" fn hypot(x: f64, y: f64) f64;
+pub extern "c" fn modff(x: f32, iptr: *f32) f32;
+pub extern "c" fn modf(x: f64, iptr: *f64) f64;
+pub extern "c" fn modfl(x: c_longdouble, iptr: *c_longdouble) c_longdouble;
+pub extern "c" fn rintf(x: f32) f32;
+pub extern "c" fn rint(x: f64) f64;
+pub extern "c" fn rintl(x: c_longdouble) c_longdouble;
+
 // OS-specific bits. These are protected from being used on the wrong OS by
 // comptime assertions inside each OS-specific file.
 
@@ -11142,6 +11227,8 @@ pub const _kern_open_dir = haiku._kern_open_dir;
 pub const _kern_read_dir = haiku._kern_read_dir;
 pub const _kern_read_stat = haiku._kern_read_stat;
 pub const _kern_rewind_dir = haiku._kern_rewind_dir;
+pub const readv_pos = haiku.readv_pos;
+pub const writev_pos = haiku.writev_pos;
 pub const area_id = haiku.area_id;
 pub const area_info = haiku.area_info;
 pub const directory_which = haiku.directory_which;
@@ -11211,7 +11298,6 @@ pub const login_getcaptime = openbsd.login_getcaptime;
 pub const login_getclass = openbsd.login_getclass;
 pub const login_getstyle = openbsd.login_getstyle;
 pub const pledge = openbsd.pledge;
-pub const pthread_spinlock_t = openbsd.pthread_spinlock_t;
 pub const pw_dup = openbsd.pw_dup;
 pub const setclasscontext = openbsd.setclasscontext;
 pub const setpassent = openbsd.setpassent;
@@ -11449,15 +11535,11 @@ pub const disown = serenity.disown;
 pub const profiling_enable = serenity.profiling_enable;
 pub const profiling_disable = serenity.profiling_disable;
 pub const profiling_free_buffer = serenity.profiling_free_buffer;
-pub const futex_wait = serenity.futex_wait;
-pub const futex_wake = serenity.futex_wake;
 pub const purge = serenity.purge;
 pub const perf_event = serenity.perf_event;
 pub const perf_register_string = serenity.perf_register_string;
 pub const get_stack_bounds = serenity.get_stack_bounds;
 pub const anon_create = serenity.anon_create;
-pub const serenity_readlink = serenity.serenity_readlink;
-pub const serenity_open = serenity.serenity_open;
 pub const getkeymap = serenity.getkeymap;
 pub const setkeymap = serenity.setkeymap;
 

package/std/compress/flate/Decompress.zig

@@ -129,8 +129,7 @@ fn discardDirect(r: *Reader, limit: std.Io.Limit) Reader.Error!usize {
     }
     const n = r.stream(&writer, limit) catch |err| switch (err) {
         error.WriteFailed => unreachable,
-        error.ReadFailed => return error.ReadFailed,
-        error.EndOfStream => return error.EndOfStream,
+        error.ReadFailed, error.EndOfStream => |e| return e,
     };
     assert(n <= @intFromEnum(limit));
     return n;
@@ -258,7 +257,7 @@ fn streamFallible(d: *Decompress, w: *Writer, limit: std.Io.Limit) Reader.Stream
                 return error.ReadFailed;
             }
         },
-        error.WriteFailed => return error.WriteFailed,
+        error.WriteFailed => |e| return e,
         else => |e| {
             // In the event of an error, state is unmodified so that it can be
             // better used to diagnose the failure.

package/std/compress/zstd/Decompress.zig

@@ -173,8 +173,7 @@ fn discardDirect(r: *Reader, limit: std.Io.Limit) Reader.Error!usize {
     }
     const n = r.stream(&writer, limit) catch |err| switch (err) {
         error.WriteFailed => unreachable,
-        error.ReadFailed => return error.ReadFailed,
-        error.EndOfStream => return error.EndOfStream,
+        error.ReadFailed, error.EndOfStream => |e| return e,
     };
     assert(n <= @intFromEnum(limit));
     return n;
@@ -252,8 +251,7 @@ fn stream(d: *Decompress, w: *Writer, limit: Limit) Reader.StreamError!usize {
         },
         .in_frame => |*in_frame| {
             return readInFrame(d, w, limit, in_frame) catch |err| switch (err) {
-                error.ReadFailed => return error.ReadFailed,
-                error.WriteFailed => return error.WriteFailed,
+                error.ReadFailed, error.WriteFailed => |e| return e,
                 else => |e| {
                     d.err = e;
                     return error.ReadFailed;

package/std/crypto/Certificate.zig

@@ -580,7 +580,10 @@ pub fn parseTime(cert: Certificate, elem: der.Element) ParseTimeError!u64 {
                 return error.CertificateTimeInvalid;
 
             return Date.toSeconds(.{
-                .year = @as(u16, 2000) + try parseTimeDigits(bytes[0..2], 0, 99),
+                .year = blk: {
+                    const year = try parseTimeDigits(bytes[0..2], 0, 99);
+                    break :blk if (year < 50) @as(u16, 2000) + year else @as(u16, 1900) + year;
+                },
                 .month = try parseTimeDigits(bytes[2..4], 1, 12),
                 .day = try parseTimeDigits(bytes[4..6], 1, 31),
                 .hour = try parseTimeDigits(bytes[6..8], 0, 23),
@@ -670,6 +673,15 @@ pub fn parseTimeDigits(text: *const [2]u8, min: u8, max: u8) !u8 {
     return @intCast(result);
 }
 
+test "parseTime UTCTime year mapping per RFC 5280" {
+    const utc_time_id: der.Identifier = .{ .tag = .utc_time, .pc = .primitive, .class = .universal };
+    const elem = der.Element{ .identifier = utc_time_id, .slice = .{ .start = 0, .end = 13 } };
+    const cert49 = Certificate{ .buffer = "490101000000Z", .index = 0 };
+    try std.testing.expectEqual(@as(u64, 2493072000), try cert49.parseTime(elem));
+    const cert99 = Certificate{ .buffer = "990101000000Z", .index = 0 };
+    try std.testing.expectEqual(@as(u64, 915148800), try cert99.parseTime(elem));
+}
+
 test parseTimeDigits {
     const expectEqual = std.testing.expectEqual;
     try expectEqual(@as(u8, 0), try parseTimeDigits("00", 0, 99));

package/std/crypto/ascon.zig

@@ -681,6 +681,8 @@ pub const AsconXof128 = struct {
 
     st: AsconState,
     squeezed: bool,
+    buf: [block_length]u8,
+    buf_len: usize,
 
     pub const Options = struct {};
 
@@ -698,7 +700,7 @@ pub const AsconXof128 = struct {
         const words: [5]u64 = .{ iv, 0, 0, 0, 0 };
         var st = AsconState.initFromWords(words);
         st.permuteR(12);
-        return AsconXof128{ .st = st, .squeezed = false };
+        return AsconXof128{ .st = st, .squeezed = false, .buf = @splat(0), .buf_len = 0 };
     }
 
     /// Hash a slice of bytes with variable-length output.
@@ -726,24 +728,26 @@ pub const AsconXof128 = struct {
 
         var i: usize = 0;
 
-        // Process full 64-bit blocks
-        while (i + 8 <= b.len) : (i += 8) {
-            self.st.addBytes(b[i..][0..8]);
+        if (self.buf_len > 0) {
+            const to_fill = @min(block_length - self.buf_len, b.len);
+            @memcpy(self.buf[self.buf_len..][0..to_fill], b[0..to_fill]);
+            self.buf_len += to_fill;
+            i += to_fill;
+            if (self.buf_len == block_length) {
+                self.st.addBytes(&self.buf);
+                self.st.permuteR(12);
+                self.buf_len = 0;
+            }
+        }
+
+        while (i + block_length <= b.len) : (i += block_length) {
+            self.st.addBytes(b[i..][0..block_length]);
             self.st.permuteR(12);
         }
 
-        // Store partial block for finalization
         if (i < b.len) {
-            var padded: [8]u8 = @splat(0);
-            const remaining = b.len - i;
-            @memcpy(padded[0..remaining], b[i..]);
-            padded[remaining] = 0x01;
-            self.st.addBytes(&padded);
-        } else {
-            // Add padding block
-            var padded: [8]u8 = @splat(0);
-            padded[0] = 0x01;
-            self.st.addBytes(&padded);
+            self.buf_len = b.len - i;
+            @memcpy(self.buf[0..self.buf_len], b[i..]);
         }
     }
 
@@ -756,7 +760,10 @@ pub const AsconXof128 = struct {
     /// After first call, no more data can be absorbed with update().
     pub fn squeeze(self: *AsconXof128, out: []u8) void {
         if (!self.squeezed) {
-            // First squeeze - apply final permutation
+            var padded: [block_length]u8 = @splat(0);
+            @memcpy(padded[0..self.buf_len], self.buf[0..self.buf_len]);
+            padded[self.buf_len] = 0x01;
+            self.st.addBytes(&padded);
             self.st.permuteR(12);
             self.squeezed = true;
         }
@@ -783,6 +790,8 @@ pub const AsconCxof128 = struct {
 
     st: AsconState,
     squeezed: bool,
+    buf: [block_length]u8,
+    buf_len: usize,
 
     pub const Options = struct { custom: []const u8 = "" };
 
@@ -804,7 +813,7 @@ pub const AsconCxof128 = struct {
         var st = AsconState.initFromWords(words);
         st.permuteR(12);
 
-        var self = AsconCxof128{ .st = st, .squeezed = false };
+        var self = AsconCxof128{ .st = st, .squeezed = false, .buf = @splat(0), .buf_len = 0 };
 
         // Process customization string - always process length and padding
         // First block: length of customization string
@@ -867,28 +876,30 @@ pub const AsconCxof128 = struct {
     ///
     /// Note: Cannot be called after squeeze() has been called
     pub fn update(self: *AsconCxof128, b: []const u8) void {
-        debug.assert(!self.squeezed);
+        debug.assert(!self.squeezed); // Cannot update after squeezing
 
         var i: usize = 0;
 
-        // Process full 64-bit blocks
-        while (i + 8 <= b.len) : (i += 8) {
-            self.st.addBytes(b[i..][0..8]);
+        if (self.buf_len > 0) {
+            const to_fill = @min(block_length - self.buf_len, b.len);
+            @memcpy(self.buf[self.buf_len..][0..to_fill], b[0..to_fill]);
+            self.buf_len += to_fill;
+            i += to_fill;
+            if (self.buf_len == block_length) {
+                self.st.addBytes(&self.buf);
+                self.st.permuteR(12);
+                self.buf_len = 0;
+            }
+        }
+
+        while (i + block_length <= b.len) : (i += block_length) {
+            self.st.addBytes(b[i..][0..block_length]);
             self.st.permuteR(12);
         }
 
-        // Store partial block for finalization
         if (i < b.len) {
-            var padded: [8]u8 = @splat(0);
-            const remaining = b.len - i;
-            @memcpy(padded[0..remaining], b[i..]);
-            padded[remaining] = 0x01;
-            self.st.addBytes(&padded);
-        } else {
-            // Add padding block
-            var padded: [8]u8 = @splat(0);
-            padded[0] = 0x01;
-            self.st.addBytes(&padded);
+            self.buf_len = b.len - i;
+            @memcpy(self.buf[0..self.buf_len], b[i..]);
         }
     }
 
@@ -901,7 +912,10 @@ pub const AsconCxof128 = struct {
     /// After first call, no more data can be absorbed with update().
     pub fn squeeze(self: *AsconCxof128, out: []u8) void {
         if (!self.squeezed) {
-            // First squeeze - apply final permutation
+            var padded: [block_length]u8 = @splat(0);
+            @memcpy(padded[0..self.buf_len], self.buf[0..self.buf_len]);
+            padded[self.buf_len] = 0x01;
+            self.st.addBytes(&padded);
             self.st.permuteR(12);
             self.squeezed = true;
         }
@@ -1267,6 +1281,34 @@ test "Ascon-XOF128 official test vectors" {
     }
 }
 
+test "Ascon-XOF128/CXOF128 streaming chunking invariance" {
+    const msg = "Hello, World!";
+
+    // XOF128: one-shot vs split must match
+    var out1: [32]u8 = undefined;
+    var out2: [32]u8 = undefined;
+    var xof1 = AsconXof128.init(.{});
+    xof1.update(msg);
+    xof1.squeeze(&out1);
+    var xof2 = AsconXof128.init(.{});
+    xof2.update("Hello, ");
+    xof2.update("World!");
+    xof2.squeeze(&out2);
+    try testing.expectEqualSlices(u8, &out1, &out2);
+
+    // CXOF128: one-shot vs split must match
+    var cout1: [32]u8 = undefined;
+    var cout2: [32]u8 = undefined;
+    var cxof1 = AsconCxof128.init(.{ .custom = "cust" });
+    cxof1.update(msg);
+    cxof1.squeeze(&cout1);
+    var cxof2 = AsconCxof128.init(.{ .custom = "cust" });
+    cxof2.update("Hello, ");
+    cxof2.update("World!");
+    cxof2.squeeze(&cout2);
+    try testing.expectEqualSlices(u8, &cout1, &cout2);
+}
+
 test "Ascon-CXOF128 official test vectors" {
 
     // Test vector 1: Empty message, empty customization, 64-byte output

package/std/crypto/codecs/asn1/Oid.zig

@@ -85,6 +85,14 @@ test toDot {
     }
 }
 
+test "malformed OID" {
+    var empty: der.Decoder = .{ .bytes = &.{ 0x06, 0x00 } };
+    try std.testing.expectError(error.EndOfStream, decodeDer(&empty));
+
+    var truncated: der.Decoder = .{ .bytes = &.{ 0x06, 0x02, 0x2a, 0x80 } };
+    try std.testing.expectError(error.InvalidEncoding, decodeDer(&truncated));
+}
+
 const TestCase = struct {
     encoded: []const u8,
     dot_notation: []const u8,
@@ -109,7 +117,10 @@ pub const asn1_tag = asn1.Tag.init(.oid, false, .universal);
 
 pub fn decodeDer(decoder: *der.Decoder) !Oid {
     const ele = try decoder.element(asn1_tag.toExpected());
-    return Oid{ .encoded = decoder.view(ele) };
+    const encoded = decoder.view(ele);
+    if (encoded.len == 0) return error.EndOfStream;
+    if (encoded[encoded.len - 1] & 0x80 != 0) return error.InvalidEncoding;
+    return Oid{ .encoded = encoded };
 }
 
 pub fn encodeDer(self: Oid, encoder: *der.Encoder) !void {

package/std/crypto/codecs/base64_hex_ct.zig

@@ -47,8 +47,7 @@ pub const hex = struct {
         }
         _ = decodeAny(bin, encoded, null) catch |err| {
             switch (err) {
-                error.InvalidCharacter => return error.InvalidCharacter,
-                error.InvalidPadding => return error.InvalidPadding,
+                error.InvalidCharacter, error.InvalidPadding => |e| return e,
                 else => unreachable,
             }
         };
@@ -228,8 +227,7 @@ pub const base64 = struct {
     pub fn decode(bin: []u8, encoded: []const u8, comptime variant: Variant) error{ InvalidCharacter, InvalidPadding }![]const u8 {
         return decodeAny(bin, encoded, variant, null) catch |err| {
             switch (err) {
-                error.InvalidCharacter => return error.InvalidCharacter,
-                error.InvalidPadding => return error.InvalidPadding,
+                error.InvalidCharacter, error.InvalidPadding => |e| return e,
                 else => unreachable,
             }
         };

package/std/crypto/ml_kem.zig

@@ -1725,15 +1725,8 @@ const NistDRBG = struct {
     v: [16]u8,
 
     fn incV(g: *NistDRBG) void {
-        var j: usize = 15;
-        while (j >= 0) : (j -= 1) {
-            if (g.v[j] == 255) {
-                g.v[j] = 0;
-            } else {
-                g.v[j] += 1;
-                break;
-            }
-        }
+        const val = std.mem.readInt(u128, &g.v, .big);
+        std.mem.writeInt(u128, &g.v, val +% 1, .big);
     }
 
     // AES256_CTR_DRBG_Update(pd, &g.key, &g.v).

package/std/crypto/tls/Client.zig

@@ -353,7 +353,7 @@ pub fn init(input: *Reader, output: *Writer, options: Options) InitError!Client
         if (record_len > tls.max_ciphertext_len) return error.TlsRecordOverflow;
         const record_buffer = input.take(record_len) catch |err| switch (err) {
             error.EndOfStream => return error.TlsConnectionTruncated,
-            error.ReadFailed => return error.ReadFailed,
+            error.ReadFailed => |e| return e,
         };
         var record_decoder: tls.Decoder = .fromTheirSlice(record_buffer);
         var ctd, const ct = content: switch (cipher_state) {
@@ -382,7 +382,9 @@ pub fn init(input: *Reader, output: *Writer, options: Options) InitError!Client
                         P.AEAD.decrypt(cleartext, ciphertext, auth_tag, record_header, nonce, pv.server_handshake_key) catch
                             return error.TlsBadRecordMac;
                         // TODO use scalar, non-slice version
-                        cleartext_fragment_end += mem.trimEnd(u8, cleartext, "\x00").len;
+                        const trimmed_len = mem.trimEnd(u8, cleartext, "\x00").len;
+                        if (trimmed_len == 0) return error.TlsDecodeError;
+                        cleartext_fragment_end += trimmed_len;
                     },
                 }
                 read_seq += 1;
@@ -1155,7 +1157,7 @@ fn readIndirect(c: *Client) Reader.Error!usize {
                 return failRead(c, error.TlsConnectionTruncated);
             }
         },
-        error.ReadFailed => return error.ReadFailed,
+        error.ReadFailed => |e| return e,
     };
     const ct: tls.ContentType = @enumFromInt(record_header[0]);
     const legacy_version = mem.readInt(u16, record_header[1..][0..2], .big);
@@ -1166,7 +1168,7 @@ fn readIndirect(c: *Client) Reader.Error!usize {
     if (record_end > input.buffered().len) {
         input.fillMore() catch |err| switch (err) {
             error.EndOfStream => return failRead(c, error.TlsConnectionTruncated),
-            error.ReadFailed => return error.ReadFailed,
+            error.ReadFailed => |e| return e,
         };
         if (record_end > input.buffered().len) return 0;
     }
@@ -1176,6 +1178,7 @@ fn readIndirect(c: *Client) Reader.Error!usize {
             .tls_1_3 => {
                 const pv = &p.tls_1_3;
                 const P = @TypeOf(p.*);
+                if (record_len < P.AEAD.tag_length) return failRead(c, error.TlsRecordOverflow);
                 const ad = input.take(tls.record_header_len) catch unreachable; // already peeked
                 const ciphertext_len = record_len - P.AEAD.tag_length;
                 const ciphertext = input.take(ciphertext_len) catch unreachable; // already peeked
@@ -1192,6 +1195,7 @@ fn readIndirect(c: *Client) Reader.Error!usize {
                     return failRead(c, error.TlsBadRecordMac);
                 // TODO use scalar, non-slice version
                 const msg = mem.trimEnd(u8, cleartext, "\x00");
+                if (msg.len == 0) return failRead(c, error.TlsDecodeError);
                 break :cleartext .{ msg.len - 1, @enumFromInt(msg[msg.len - 1]) };
             },
             .tls_1_2 => {
@@ -1668,3 +1672,74 @@ else
         .AES_256_GCM_SHA384,
         .ECDHE_RSA_WITH_AES_256_GCM_SHA384,
     });
+
+fn testReadError(input_buf: []const u8, cipher: tls.ApplicationCipher) ReadError {
+    var input_reader: Reader = .fixed(input_buf);
+    var read_buf: [tls.max_ciphertext_record_len]u8 = undefined;
+    var c: Client = .{
+        .input = &input_reader,
+        .reader = .{
+            .buffer = &read_buf,
+            .vtable = &.{ .stream = stream, .readVec = readVec },
+            .seek = 0,
+            .end = 0,
+        },
+        .output = undefined,
+        .writer = undefined,
+        .tls_version = .tls_1_3,
+        .read_seq = 0,
+        .write_seq = 0,
+        .received_close_notify = false,
+        .allow_truncation_attacks = false,
+        .application_cipher = cipher,
+        .ssl_key_log = null,
+    };
+    var w: Writer = .failing;
+    std.testing.expectError(error.ReadFailed, c.reader.stream(&w, .unlimited)) catch
+        @panic("expected ReadFailed");
+    return c.read_err.?;
+}
+
+test "empty inner plaintext" {
+    const AEAD = crypto.aead.chacha_poly.ChaCha20Poly1305;
+    const key: [AEAD.key_length]u8 = @splat(0);
+    const iv: [AEAD.nonce_length]u8 = @splat(0);
+
+    const plaintext = [1]u8{0x00};
+    var ciphertext: [plaintext.len]u8 = undefined;
+    var tag: [AEAD.tag_length]u8 = undefined;
+    const content_len: u16 = plaintext.len + AEAD.tag_length;
+    const record_header = [_]u8{ 0x17, 0x03, 0x03 } ++ mem.toBytes(big(content_len));
+    AEAD.encrypt(&ciphertext, &tag, &plaintext, &record_header, iv, key);
+
+    try std.testing.expectEqual(error.TlsDecodeError, testReadError(
+        &record_header ++ ciphertext ++ tag,
+        .{ .CHACHA20_POLY1305_SHA256 = .{ .tls_1_3 = .{
+            .server_key = key,
+            .server_iv = iv,
+            .client_secret = undefined,
+            .server_secret = undefined,
+            .client_key = undefined,
+            .client_iv = undefined,
+        } } },
+    ));
+}
+
+test "record shorter than tag" {
+    const AEAD = crypto.aead.chacha_poly.ChaCha20Poly1305;
+    const record_len: u16 = AEAD.tag_length - 1;
+    const header = [_]u8{ 0x17, 0x03, 0x03 } ++ mem.toBytes(big(record_len));
+    const wire = header ++ @as([record_len]u8, @splat(0));
+
+    try std.testing.expectEqual(error.TlsRecordOverflow, testReadError(
+        &wire,
+        .{ .CHACHA20_POLY1305_SHA256 = .{ .tls_1_3 = .{
+            .server_key = undefined,
+            .server_iv = undefined,
+            .client_secret = undefined,
+            .server_secret = undefined,
+            .client_key = undefined,
+            .client_iv = undefined,
+        } } },
+    ));
+}

package/std/crypto/tls.zig

@@ -666,7 +666,7 @@ pub const Decoder = struct {
         if (request_amt > dest.len) return error.TlsRecordOverflow;
         stream.readSlice(dest[0..request_amt]) catch |err| switch (err) {
             error.EndOfStream => return error.TlsConnectionTruncated,
-            error.ReadFailed => return error.ReadFailed,
+            error.ReadFailed => |e| return e,
         };
         d.cap += request_amt;
     }

package/std/crypto.zig

@@ -367,6 +367,7 @@ test {
     _ = ff;
     _ = errors;
     _ = tls;
+    _ = tls.Client;
     _ = Certificate;
     _ = codecs;
 }

package/std/debug/Pdb.zig

@@ -138,7 +138,7 @@ pub fn parseDbiStream(self: *Pdb) !void {
     if (section_contrib_size != 0) {
         const version = reader.takeEnum(pdb.SectionContrSubstreamVersion, .little) catch |err| switch (err) {
             error.InvalidEnumTag, error.EndOfStream => return error.InvalidDebugInfo,
-            error.ReadFailed => return error.ReadFailed,
+            error.ReadFailed => |e| return e,
         };
         _ = version;
         sect_cont_offset += @sizeOf(u32);

package/std/debug.zig

@@ -1197,8 +1197,9 @@ fn printSourceAtAddress(
 
     // Initialize the symbol array with space for at least one element, allocating this on the stack
     // in the common case where only one element is needed
-    var symbol_fallback_allocator = std.heap.stackFallback(@sizeOf(Symbol) + @alignOf(Symbol) - 1, getDebugInfoAllocator());
-    const symbol_allocator = symbol_fallback_allocator.get();
+    var buf: [1]Symbol = undefined;
+    var bfa: std.heap.BufferFirstAllocator = .init(@ptrCast(&buf), getDebugInfoAllocator());
+    const symbol_allocator = bfa.allocator();
     var symbols = std.ArrayList(Symbol).initCapacity(symbol_allocator, 1) catch unreachable;
     defer symbols.deinit(symbol_allocator);
 
@@ -1576,12 +1577,12 @@ fn handleSegfaultPosix(sig: posix.SIG, info: *const posix.siginfo_t, ctx_ptr: ?*
             .tvos,
             .visionos,
             .watchos,
+            .haiku,
             => @intFromPtr(info.addr),
             .linux,
             => @intFromPtr(info.fields.sigfault.addr),
             .netbsd,
             => @intFromPtr(info.info.reason.fault.addr),
-            .haiku,
             .openbsd,
             => @intFromPtr(info.data.fault.addr),
             .illumos,