fix: address re-review — coverage build, chunk OOB guard, UBSan loads, srand scope

- Remove -DSTRICT_WARNINGS=ON from coverage job (_FORTIFY_SOURCE + -O0 + -Werror fatal)
- Fix chunk.c metadata guard: peek at present flag before calling metadata_from_buf
  so the remaining_size check covers the full sizeof(int)+FILE_METADATA_WIRE_SIZE
- Fix chunk.c UBSan misaligned loads: use memcpy instead of *(size_t*)deref
- Move srand(42) to test_property() top level so all property tests are seeded

.gitea/workflows/ci.yaml

@@ -79,7 +79,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Configure
-        run: cmake -B build -S . -DENABLE_COVERAGE=ON -DSTRICT_WARNINGS=ON
+        run: cmake -B build -S . -DENABLE_COVERAGE=ON
 
       - name: Build
         run: cmake --build build -j$(nproc)
@@ -89,8 +89,8 @@ jobs:
 
       - name: Coverage Report
         run: |
-          lcov --capture --directory build --output-file coverage.info --branch-coverage
+          lcov --capture --directory build --output-file coverage.info --branch-coverage --ignore-errors negative
-          lcov --remove coverage.info '/usr/*' '*/tests/*' '*/_deps/*' --output-file coverage.info --branch-coverage --ignore-errors unused
+          lcov --remove coverage.info '/usr/*' '*/tests/*' '*/_deps/*' --output-file coverage.info --branch-coverage --ignore-errors unused,negative
           lcov --list coverage.info
 
   valgrind:

src/shared/chunk.c

@@ -95,7 +95,8 @@ Chunk* chunk_deserialize(Data* data, bool use_metadata) {
       return NULL;
     }
 
-    size_t path_len = *(size_t*)data_pointer;
+    size_t path_len;
+    memcpy(&path_len, data_pointer, sizeof(size_t));
     data_pointer += sizeof(size_t);
     remaining_size -= sizeof(size_t);
 
@@ -125,19 +126,19 @@ Chunk* chunk_deserialize(Data* data, bool use_metadata) {
         array_list_delete(files);
         return NULL;
       }
-      file->metadata = metadata_from_buf(&data_pointer);
+      // Peek at present flag to determine total size needed before reading
-      remaining_size -= sizeof(int);
+      int present_flag;
-      if (file->metadata) {
+      memcpy(&present_flag, data_pointer, sizeof(int));
-        if (remaining_size < FILE_METADATA_WIRE_SIZE) {
+      if (present_flag && remaining_size < sizeof(int) + FILE_METADATA_WIRE_SIZE) {
         log_message(LOG_LEVEL_ERROR, "Invalid chunk format: not enough data for metadata body");
-          free(file->metadata);
-          file->metadata = NULL;
         array_list_delete(files);
         return NULL;
       }
+      file->metadata = metadata_from_buf(&data_pointer);
+      remaining_size -= sizeof(int);
+      if (file->metadata)
         remaining_size -= FILE_METADATA_WIRE_SIZE;
     }
-    }
 
     if (remaining_size < sizeof(size_t)) {
       log_message(LOG_LEVEL_ERROR, "Invalid chunk format: not enough data for data size");
@@ -145,7 +146,8 @@ Chunk* chunk_deserialize(Data* data, bool use_metadata) {
       return NULL;
     }
 
-    size_t file_data_size = *(size_t*)data_pointer;
+    size_t file_data_size;
+    memcpy(&file_data_size, data_pointer, sizeof(size_t));
     data_pointer += sizeof(size_t);
     remaining_size -= sizeof(size_t);
 

tests/test_property.c

@@ -20,7 +20,6 @@ static Data* random_data(int min_size, int max_size) {
 }
 
 static void test_property_compress_roundtrip() {
-  srand(42);
   for (int iter = 0; iter < 10; iter++) {
     Data* original = random_data(1, 10000);
     EXPECT_NOT_NULL(original);
@@ -114,6 +113,7 @@ static void test_property_chunk_roundtrip() {
 }
 
 void test_property() {
+  srand(42);
   test_property_compress_roundtrip();
   test_property_delta_roundtrip();
   test_property_chunk_roundtrip();