winreg_core/
bytes.rs

1//! Bounds-checked little-endian integer readers.
2//!
3//! Registry hives are untrusted, attacker-controllable input. These helpers
4//! read fixed-width integers without ever panicking on a crafted offset/length:
5//! an out-of-range read yields `0` rather than an out-of-bounds slice panic.
6//! Using them (instead of `data[a..b].try_into().unwrap()`) keeps the parser
7//! panic-free even if a future change breaks a caller's bounds guard — the
8//! defence-in-depth the Paranoid-Gatekeeper standard requires.
9
10/// Read a little-endian `u32` at `off`, or `0` if `off..off+4` is out of range.
11#[must_use]
12pub fn le_u32(data: &[u8], off: usize) -> u32 {
13    data.get(off..off.wrapping_add(4))
14        .and_then(|s| <[u8; 4]>::try_from(s).ok())
15        .map_or(0, u32::from_le_bytes)
16}
17
18/// Read a little-endian `u64` at `off`, or `0` if `off..off+8` is out of range.
19#[must_use]
20pub fn le_u64(data: &[u8], off: usize) -> u64 {
21    data.get(off..off.wrapping_add(8))
22        .and_then(|s| <[u8; 8]>::try_from(s).ok())
23        .map_or(0, u64::from_le_bytes)
24}
25
26#[cfg(test)]
27mod tests {
28    use super::*;
29
30    #[test]
31    fn le_u32_reads_value() {
32        assert_eq!(le_u32(&[0x01, 0x02, 0x03, 0x04], 0), 0x0403_0201);
33        assert_eq!(le_u32(&[0xFF, 0x01, 0x02, 0x03, 0x04], 1), 0x0403_0201);
34    }
35
36    #[test]
37    fn le_u32_out_of_range_is_zero_not_panic() {
38        assert_eq!(le_u32(&[1, 2, 3], 0), 0); // too short
39        assert_eq!(le_u32(&[1, 2, 3, 4], 2), 0); // off+4 overruns
40        assert_eq!(le_u32(&[], 0), 0);
41        assert_eq!(le_u32(&[1, 2, 3, 4], usize::MAX), 0); // no overflow panic
42    }
43
44    #[test]
45    fn le_u64_reads_value_and_guards() {
46        assert_eq!(le_u64(&[1, 0, 0, 0, 0, 0, 0, 0], 0), 1);
47        assert_eq!(le_u64(&[1, 2, 3, 4, 5, 6, 7], 0), 0); // too short
48        assert_eq!(le_u64(&[0; 8], usize::MAX), 0); // no overflow panic
49    }
50}
winreg_core/bytes.rs

winreg_core/
bytes.rs
