RayPals/Claro
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: release PUT expression temporaries

Browse Source
This commit is contained in:
Hermes Agent
2026-09-26 02:07:00 +00:00
parent d668594478
commit e4ded3acc7
4 changed files with 52 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/HARDENING.md
+2
View File
@@ -33,6 +33,8 @@ Focused verification builds with AddressSanitizer/UndefinedBehaviorSanitizer, re
The `REMOVE` command now releases its evaluated needle and copied list/map value after updating runtime storage. Focused verification: `python3 tools/validate_remove_expression_cleanup.py` runs 2,000 discarded string needles under ASan/UBSan/LSan; it passed with no reported leaks. This slice does not yet address the separate ownership of an item removed from a populated copied list.
The `PUT ... KEY ... VALUE ...` command now releases its evaluated map, key, and value copies after `map_put`/`rt_set` have copied the data they own. Focused verification: `python3 tools/validate_put_expression_cleanup.py` exercises 2,000 string-valued writes under ASan/UBSan/LSan and passes with no reported leaks. This covers expression-temporary ownership only; broader malformed-input sanitizer runs still report the previously documented `rt_error` diagnostic-string leaks.
## HTTP response handling
HTTP responses are capped at 1,048,576 bytes. Exceeding the cap produces a beginner-facing runtime error instead of retaining an unbounded response. The curl status suffix is taken from the final status marker, so a response body containing marker-like text is preserved. Existing `HTTP CHECK` URL safety rules remain unchanged.