Merge pull request 'Fix undefined behavior on empty input in strinc() and prefixRange()' (#60) from weaselbot/conflict-set:weaselbot/issue-59 into main

Reviewed-on: weaselab/conflict-set#60

Bench.cpp

@@ -37,15 +37,16 @@ ConflictSet::ReadRange singleton(Arena &arena, TrivialSpan key) {
 }
 
 ConflictSet::ReadRange prefixRange(Arena &arena, TrivialSpan key) {
-  int index;
-  for (index = key.size() - 1; index >= 0; index--)
-    if ((key[index]) != 255)
+  int index = key.size() - 1;
+  for (; index >= 0; index--)
+    if (key[index] != 255)
       break;
 
   // Must not be called with a string that consists only of zero or more '\xff'
-  // bytes.
+  // bytes, or with an empty string (which has no finite upper bound).
   if (index < 0) {
     assert(false);
+    std::abort();
   }
 
   uint8_t *buf = new (arena) uint8_t[index + 1];

ConflictSet.cpp

@@ -5679,13 +5679,13 @@ std::string getPartialKeyPrintable(Node *n) {
 }
 
 std::string strinc(std::string_view str, bool &ok) {
-  int index;
-  for (index = str.size() - 1; index >= 0; index--)
-    if ((uint8_t &)(str[index]) != 255)
+  int index = static_cast<int>(str.size()) - 1;
+  for (; index >= 0; index--)
+    if (static_cast<uint8_t>(str[index]) != 255)
       break;
 
   // Must not be called with a string that consists only of zero or more
-  // '\xff' bytes.
+  // '\xff' bytes, and the empty string has no successor.
   if (index < 0) {
     ok = false;
     return {};
@@ -5693,7 +5693,8 @@ std::string strinc(std::string_view str, bool &ok) {
   ok = true;
 
   auto r = std::string(str.substr(0, index + 1));
-  ((uint8_t &)r[r.size() - 1])++;
+  auto &last = r[r.size() - 1];
+  last = static_cast<char>(static_cast<uint8_t>(last) + 1);
   return r;
 }