{"record":{"id":"e035eefa3f9701e4","repo":"astrid-runtime/astrid","slug":"mount-source-has-nul","errorCode":null,"errorMessage":"mount source has NUL","messagePattern":"mount source has NUL","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"info","filePath":"crates/astrid-vfs/src/workspace_cow/overlayfs.rs","lineNumber":494,"sourceCode":"        Some(libc::ENODATA | libc::ENOTSUP) => Ok(false),\n        _ => Err(err),\n    }\n}\n\n/// A short, deterministic hex digest of a path, used only as a directory name.\nfn path_hash(path: &Path) -> String {\n    use std::collections::hash_map::DefaultHasher;\n    use std::hash::{Hash, Hasher};\n    let key = std::fs::canonicalize(path).unwrap_or_else(|_| path.to_path_buf());\n    let mut hasher = DefaultHasher::new();\n    key.hash(&mut hasher);\n    format!(\"{:016x}\", hasher.finish())\n}\n\n/// `mount(\"overlay\", target, \"overlay\", 0, data)`.\nfn mount_overlay(target: &Path, data: &str) -> io::Result<()> {\n    let src = CString::new(\"overlay\")\n        .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, \"mount source has NUL\"))?;\n    let fstype = CString::new(\"overlay\")\n        .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, \"mount fstype has NUL\"))?;\n    let target_c = CString::new(target.as_os_str().as_bytes())\n        .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, \"mount target has NUL\"))?;\n    let data_c = CString::new(data)\n        .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, \"mount data has NUL\"))?;\n    // SAFETY: all four pointers are valid, NUL-terminated C strings that outlive\n    // the call; `mount` reads them and returns a status code, retaining no\n    // pointers. `data` is the overlayfs option string.\n    let rc = unsafe {\n        libc::mount(\n            src.as_ptr(),\n            target_c.as_ptr(),\n            fstype.as_ptr(),\n            0,\n            data_c.as_ptr().cast(),\n        )\n    };","sourceCodeStart":476,"sourceCodeEnd":512,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-vfs/src/workspace_cow/overlayfs.rs#L476-L512","documentation":"mount_overlay converts its mount(2) arguments to CStrings before the FFI call. The literal source \"overlay\" is a constant and can never contain NUL, so this arm is a defensive invariant check that fires only if the constant were changed; the library fails closed with InvalidInput instead of passing a bad pointer to mount(2).","triggerScenarios":"Practically unreachable: the source string is the hard-coded literal \"overlay\". It would only fire if the literal were edited to a value containing an embedded NUL byte.","commonSituations":"Reviewers/maintainers modifying the constant; static-analysis tooling flagging the unreachable error path.","solutions":["Leave as-is; this is a defensive check on a compile-time constant","If it ever fires, inspect recent edits to the \"overlay\" literal for accidental NUL injection"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Unreachable for the hard-coded \"overlay\" literal; no caller-side check needed.","typeGuard":null,"tryCatchPattern":"// On InvalidInput from mount_overlay, treat as an internal bug and log/report it.","preventionTips":["Do not edit the \"overlay\" source literal to a dynamically supplied string","Treat this error arm as an invariant, not an expected failure"],"tags":["ffi","mount","cstring","defensive"],"backgroundTag":"internal-invariant-violation","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}