luna-core 3.2.2

//! Byte-stream reader shared by `super::luna` (luna's own body format) and
//! the per-dialect PUC translators (`super::puc::puc_5{1,2,3,4,5}`).
//!
//! Stays stdlib-only — the luna-core 0-dep contract forbids pulling in
//! `byteorder`, `nom`, or a ULEB128 crate.

use super::error::Bad;

/// Cursor over a slice of bytes with truncation-safe primitive readers.
pub(super) struct Reader<'a> {
    b: &'a [u8],
    p: usize,
    depth: u32,
}

/// Deepest function nesting a chunk may have. The compilers stop at 200
/// syntax levels, so no compiled chunk comes near it; the readers, the
/// translator and the verifier all recurse once per level.
const MAX_NESTING: u32 = 250;

impl<'a> Reader<'a> {
    /// Start a reader at byte offset 0.
    #[allow(dead_code)] // not used yet
    pub(super) fn new(b: &'a [u8]) -> Self {
        Self { b, p: 0, depth: 0 }
    }

    /// Start a reader at byte offset `p` (luna's `undump` skips the
    /// header + body-tag bytes before constructing the reader).
    pub(super) fn at(b: &'a [u8], p: usize) -> Self {
        Self { b, p, depth: 0 }
    }

    /// Read a nested function with `f`, refusing one nested deeper than
    /// `MAX_NESTING`.
    pub(super) fn nested<T>(
        &mut self,
        f: impl FnOnce(&mut Self) -> Result<T, Bad>,
    ) -> Result<T, Bad> {
        if self.depth >= MAX_NESTING {
            return Err(Bad::Code("functions nested too deep".to_string()));
        }
        self.depth += 1;
        let r = f(self);
        self.depth -= 1;
        r
    }

    /// Current byte position.
    pub(super) fn pos(&self) -> usize {
        self.p
    }

    pub(super) fn take(&mut self, n: usize) -> Result<&'a [u8], Bad> {
        let end = self.p.checked_add(n).ok_or(Bad::Truncated)?;
        let slice = self.b.get(self.p..end).ok_or(Bad::Truncated)?;
        self.p = end;
        Ok(slice)
    }

    pub(super) fn u8(&mut self) -> Result<u8, Bad> {
        Ok(self.take(1)?[0])
    }

    pub(super) fn u32(&mut self) -> Result<u32, Bad> {
        Ok(u32::from_le_bytes(self.take(4)?.try_into().unwrap()))
    }

    /// A dumped element count, refused when the chunk has fewer than
    /// `min_size` bytes left per element — the count sizes an allocation,
    /// and a corrupt one must not request gigabytes before the reads that
    /// would have caught the truncation.
    pub(super) fn count(&self, n: u64, min_size: usize) -> Result<usize, Bad> {
        let left = (self.b.len() - self.p) as u64;
        match n.checked_mul(min_size as u64) {
            Some(need) if need <= left => Ok(n as usize),
            _ => Err(Bad::Truncated),
        }
    }

    pub(super) fn bytes(&mut self) -> Result<&'a [u8], Bad> {
        let n = self.u32()? as usize;
        self.take(n)
    }

    /// Borrow the underlying byte slice. Used by `puc_51` to rewind a
    /// look-ahead peek (PUC 5.1's nested-proto recursion needs to look
    /// one byte ahead — the child's `nups` — before letting the
    /// recursive r_proto consume the full child header from scratch).
    #[allow(dead_code)]
    pub(super) fn peek_underlying_slice(&self) -> &'a [u8] {
        self.b
    }

    /// Advance the reader to byte position `to`. Mirrors the rewind /
    /// re-seek pattern needed by `puc_51`'s look-ahead.
    #[allow(dead_code)]
    pub(super) fn skip_to(&mut self, to: usize) -> Result<(), Bad> {
        if to < self.p || to > self.b.len() {
            return Err(Bad::Code(format!(
                "skip_to {to} out of range (cur {}, len {})",
                self.p,
                self.b.len()
            )));
        }
        self.p = to;
        Ok(())
    }
}

/// PUC `lundump.c::loadVarint` / `loadSize` / `loadInt` MSB-first
/// big-endian varint used by 5.5 for string lengths, instruction counts,
/// line offsets, etc. The encoding (per `ldump.c::dumpVarint`):
///
/// > Bytes are written most-significant-first; each non-terminal byte has
/// > the high bit (0x80) **set**; the last byte has the high bit **clear**.
/// > Each byte carries 7 payload bits, and the accumulator is built as
/// > `acc = (acc << 7) | (b & 0x7f)`.
///
/// (Note: this is the MIRROR of LEB128 / DWARF "continuation = high bit
/// set, LSB-first"; see `lua-5.5.1/src/ldump.c::dumpVarint` and
/// `lua-5.5.1/src/lundump.c::loadVarint`.)
///
/// Hand-rolled to keep the luna-core 0-dep contract (no `leb128` crate).
/// Caps at 10 payload bytes (u64 saturation); rejects overflow.
#[allow(dead_code)] // only the PUC translators call this
pub(super) fn read_puc_varint(r: &mut Reader) -> Result<u64, Bad> {
    let mut acc: u64 = 0;
    for _ in 0..10 {
        let byte = r.u8()?;
        // Detect overflow: about to shift the accumulator left by 7 bits.
        // If any of the top 7 bits of `acc` are set, the new bits would
        // be lost — that's a u64 overflow.
        if acc >> 57 != 0 {
            return Err(Bad::IntOverflow);
        }
        acc = (acc << 7) | (byte & 0x7f) as u64;
        if byte & 0x80 == 0 {
            // high bit clear = last byte
            return Ok(acc);
        }
    }
    Err(Bad::IntOverflow)
}