This is an automated email from the ASF dual-hosted git repository. sjanc pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/mynewt-newt.git
commit 26ab97a7f5d9c907dbc6d5cb19622b7498a6491c Author: Szymon Janc <[email protected]> AuthorDate: Mon Oct 19 17:47:10 2026 +0200 newt/compat: Fix panic on duplicate version in compatibility table A newt_compatibility table could contain the same newt version twice using different spellings, e.g. "1.0.0: good" and "1.0.00: error". Depending on map iteration order the good range was then computed reversed and CheckNewtVer indexed the table at -1. Reject tables with duplicate newt versions with an error. Assisted-by: Claude:claude-opus-5-5 --- newt/compat/compat.go | 8 +++++ newt/compat/compat_test.go | 81 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 89 insertions(+) diff --git a/newt/compat/compat.go b/newt/compat/compat.go index 4034ff66..5d7bcb34 100644 --- a/newt/compat/compat.go +++ b/newt/compat/compat.go @@ -101,6 +101,14 @@ func ParseNcTable(strMap map[string]string) (NewtCompatTable, error) { sortEntries(tbl) + for i := 1; i < len(tbl); i++ { + if newtutil.VerCmp(tbl[i-1].minNewtVer, tbl[i].minNewtVer) == 0 { + return nil, util.FmtNewtError("Newt compatibility table "+ + "contains duplicate newt version: %s", + tbl[i].minNewtVer.String()) + } + } + return tbl, nil } diff --git a/newt/compat/compat_test.go b/newt/compat/compat_test.go new file mode 100644 index 00000000..a1811a48 --- /dev/null +++ b/newt/compat/compat_test.go @@ -0,0 +1,81 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +package compat + +import ( + "testing" + + "mynewt.apache.org/newt/newt/newtutil" +) + +func compatTestVer(t *testing.T, s string) newtutil.Version { + t.Helper() + v, err := newtutil.ParseVersion(s) + if err != nil { + t.Fatalf("failed to parse version %q: %v", s, err) + } + return v +} + +func TestParseNcTableDuplicateVersion(t *testing.T) { + strMap := map[string]string{ + "1.0.0": "good", + "1.0.00": "error", + } + + // The order of map iteration is random; repeat to cover both orders + // of the duplicate entries. + for i := 0; i < 20; i++ { + tbl, err := ParseNcTable(strMap) + if err == nil { + // Without duplicate detection this could panic. + tbl.CheckNewtVer(compatTestVer(t, "0.9.0")) + t.Fatalf("expected error for duplicate newt version") + } + } +} + +func TestCheckNewtVer(t *testing.T) { + tbl, err := ParseNcTable(map[string]string{ + "1.0.0": "good", + "2.0.0": "error", + }) + if err != nil { + t.Fatalf("unexpected error: %v", err) + } + + tests := []struct { + ver newtutil.Version + code NewtCompatCode + }{ + {compatTestVer(t, "0.9.0"), NEWT_COMPAT_ERROR}, + {compatTestVer(t, "1.0.0"), NEWT_COMPAT_GOOD}, + {compatTestVer(t, "1.5.0"), NEWT_COMPAT_GOOD}, + {compatTestVer(t, "2.0.0"), NEWT_COMPAT_ERROR}, + } + + for _, tc := range tests { + code, _ := tbl.CheckNewtVer(tc.ver) + if code != tc.code { + t.Errorf("newt %s: expected code %d, got %d", + tc.ver.String(), tc.code, code) + } + } +}
