Replace unsafe numeric parsing with std::from_chars + hardening#167
Conversation
|
from_chars is a C++17 API. This would be a breaking change that would necessitate a major version bump, and I'm not comfortable committing to that at this moment. I'm happy with a push to simplify code and improve readability, but I'd like it to remain compatible. |
Taywee
left a comment
There was a problem hiding this comment.
I don't want to bump the required standard to C++17.
|
Thanks for the clarification. |
|
@Taywee applied the changes as u requested |
|
Looks better. I am happy to have that hacky manual parsing implementation out of the code. Thanks for the PR. |
This pull request hardens the numeric parsing implementation in the ARGS library by replacing manual pointer-based parsing logic with the standard-library
std::from_charsAPI, adding optional validation hardening checks, and introducing a fuzzing harness for continuous parser validation.The previous implementation relied on custom pointer manipulation and manual base-detection logic while parsing user-controlled input. Although no direct memory corruption vulnerability was identified, these patterns increase long-term maintenance complexity and create unnecessary parsing risk around malformed, adversarial, or boundary-case numeric inputs.
This patch improves the overall security posture, reliability, and auditability of the parser while maintaining full backward compatibility.
Security Rationale
Problem Statement
The original numeric parsing implementation performed manual parsing operations on user-provided strings, including:
errnorestoration behaviorExample patterns from the previous implementation included: