{"record":{"id":"8dc556eb408959c6","repo":"astrid-runtime/astrid","slug":"invalid-mount-escape","errorCode":null,"errorMessage":"invalid mount escape","messagePattern":"invalid mount escape","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-kernel/src/lib.rs","lineNumber":4416,"sourceCode":"    let canonical = std::fs::canonicalize(path)?;\n    let mountinfo = std::fs::read_to_string(\"/proc/self/mountinfo\")?;\n    for line in mountinfo.lines() {\n        let Some(encoded) = line.split_whitespace().nth(4) else {\n            continue;\n        };\n        let mut decoded = Vec::with_capacity(encoded.len());\n        let bytes = encoded.as_bytes();\n        let mut index = 0;\n        while index < bytes.len() {\n            let escape_end = index.checked_add(4).ok_or_else(|| {\n                std::io::Error::new(std::io::ErrorKind::InvalidData, \"mount path overflow\")\n            })?;\n            let escape_start = index.checked_add(1).ok_or_else(|| {\n                std::io::Error::new(std::io::ErrorKind::InvalidData, \"mount path overflow\")\n            })?;\n            if bytes[index] == b'\\\\' && escape_end <= bytes.len() {\n                let digits = bytes.get(escape_start..escape_end).ok_or_else(|| {\n                    std::io::Error::new(std::io::ErrorKind::InvalidData, \"invalid mount escape\")\n                })?;\n                if digits.iter().all(|digit| (b'0'..=b'7').contains(digit)) {\n                    let value = u8::from_str_radix(\n                        std::str::from_utf8(digits).map_err(std::io::Error::other)?,\n                        8,\n                    )\n                    .map_err(std::io::Error::other)?;\n                    decoded.push(value);\n                    index = escape_end;\n                    continue;\n                }\n            }\n            decoded.push(bytes[index]);\n            index = index.checked_add(1).ok_or_else(|| {\n                std::io::Error::new(std::io::ErrorKind::InvalidData, \"mount path overflow\")\n            })?;\n        }\n        if std::ffi::OsString::from_vec(decoded) == canonical.as_os_str() {","sourceCodeStart":4398,"sourceCodeEnd":4434,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-kernel/src/lib.rs#L4398-L4434","documentation":"Raised when the escape decoder sees a backslash but the 3 following bytes cannot be retrieved (slice out of bounds) while decoding mount paths. Since escape_end <= bytes.len() was already checked, this indicates malformed internal index bookkeeping; the library converts it to InvalidData 'invalid mount escape'.","triggerScenarios":"Decoding an encoded mount path where the slice get(escape_start..escape_end) unexpectedly returns None during escape processing.","commonSituations":"Corrupted or hand-edited encoded path records; inconsistent bounds after a prior overflow check; fuzzed or adversarial input to the path-verification API.","solutions":["Regenerate the encoded mount path from the real canonical path instead of repairing bytes by hand","Verify the input string only contains valid \\\\NNN octal escapes (3 octal digits after backslash)","Ensure the string passed in was produced by the library's own encoder, not transformed elsewhere (e.g. JSON escaping)","Add a pre-check that every backslash in the input is followed by exactly three octal digits"],"exampleFix":"// before\nverify_mount_path(\"\\\\12x malformed\");\n// after\nverify_mount_path(\"\\\\101 r \\\\165 n\"); // valid \\\\NNN octal escapes only","handlingStrategy":"validation","validationCode":"fn escapes_valid(s: &str) -> bool {\n    let b = s.as_bytes();\n    (0..b.len()).all(|i| b[i] != b'\\\\' || (i + 4 <= b.len() && b[i+1..i+4].iter().all(|d| (b'0'..=b'7').contains(d))))\n}","typeGuard":"fn is_octal_escape(b: &[u8], i: usize) -> bool {\n    i + 4 <= b.len() && b[i] == b'\\\\' && b[i+1..i+4].iter().all(|d| (b'0'..=b'7').contains(d))\n}","tryCatchPattern":"match verify_mount_path(canonical, encoded) {\n    Err(e) if e.to_string().contains(\"invalid mount escape\") => eprintln!(\"malformed escape in path record\"),\n    r => r?,\n}","preventionTips":["Only consume strings produced by the library's own encoder","Avoid double-escaping through shell/JSON layers","Pre-validate every '\\\\' is followed by three octal digits"],"tags":["path-decoding","escape-sequence","validation"],"backgroundTag":"invalid-argument-format","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}