Alex Goodman cd57b0704e

chore(lint): add ruleguard rules for unguarded reads in binary parsers ...

Four rules covering the bug classes behind a batch of parser hardening work:
allocations sized from a header field, decompression with no ceiling, bounds
checks that wrap on unsigned operands, and reads that report end-of-file as
success.

This currently fails with 19 findings, all triaged. Every real one has a fix in
flight on a sibling branch, so this should land last.

Suppressions are deliberately left out for now. Several sites keep firing once
correctly fixed, mostly because the decompression rule flags a constructor and
cannot see the limit applied on the next line. That is a reason to refine the
rule rather than bulk-add nolints.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

2026-08-14 09:53:52 -04:00

..

rules.go

chore(lint): add ruleguard rules for unguarded reads in binary parsers

2026-08-14 09:53:52 -04:00