Fix a case of undefined behavior in `URITemplateRouter` by jviotti · Pull Request #2612 · sourcemeta/core

jviotti · 2026-07-07T21:34:48Z

Signed-off-by: Juan Cruz Viotti jv@jviotti.com

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

augmentcode · 2026-07-07T21:38:07Z

🤖 Augment PR Summary

Summary: This PR fixes undefined behavior in URITemplateRouterView when it is constructed from an unaligned external byte buffer.

Changes:

Adds a compile-time check ensuring RouterHeader size is a multiple of the serialized node alignment
Updates the URITemplateRouterView(const std::uint8_t*, std::size_t) constructor to keep zero-copy when aligned, but mirror misaligned buffers into 8-byte-aligned owned storage
Stores the aligned copy in a new owned_ member to ensure the backing memory outlives the view
Adds a regression test that offsets serialized bytes by one to force misalignment and verifies matching still works

Technical Notes: The change prevents over-aligned reads of SerializedNode from an unaligned address, which would otherwise be undefined behavior.

_{🤖 Was this summary useful? React with 👍 or 👎}

augmentcode

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

augmentcode · 2026-07-07T21:38:08Z

+  // mirror it into aligned storage that outlives the view
+  if (data != nullptr &&
+      (reinterpret_cast<std::uintptr_t>(data) % alignof(SerializedNode)) != 0) {
+    this->owned_.resize((size + sizeof(std::uint64_t) - 1) /


src/core/uritemplate/uritemplate_router_view.cc:544: The owned_.resize((size + sizeof(std::uint64_t) - 1) / sizeof(std::uint64_t)) rounding can overflow size_t for very large size, potentially leading to an undersized allocation followed by an out-of-bounds std::memcpy. Consider adding an explicit overflow guard before the size + ... addition.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

cubic-dev-ai

1 issue found across 3 files

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/core/uritemplate/uritemplate_router_view.cc">

<violation number="1" location="src/core/uritemplate/uritemplate_router_view.cc:542">
P2: An unaligned external buffer can make this constructor copy into undersized or empty storage before any later validation runs. Computing the rounded word count without addition overflow and skipping zero-length buffers would keep the alignment fallback safe.</violation>
</file>

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

cubic-dev-ai · 2026-07-07T21:40:35Z

+  if (data != nullptr &&
+      (reinterpret_cast<std::uintptr_t>(data) % alignof(SerializedNode)) != 0) {
+    this->owned_.resize((size + sizeof(std::uint64_t) - 1) /
+                        sizeof(std::uint64_t));


P2: An unaligned external buffer can make this constructor copy into undersized or empty storage before any later validation runs. Computing the rounded word count without addition overflow and skipping zero-length buffers would keep the alignment fallback safe.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/core/uritemplate/uritemplate_router_view.cc, line 542: <comment>An unaligned external buffer can make this constructor copy into undersized or empty storage before any later validation runs. Computing the rounded word count without addition overflow and skipping zero-length buffers would keep the alignment fallback safe.</comment> <file context> @@ -530,7 +534,19 @@ URITemplateRouterView::URITemplateRouterView( + // unaligned external buffer would make those reads undefined. Keep the + // zero-copy path when the caller's buffer is already aligned, and otherwise + // mirror it into aligned storage that outlives the view + if (data != nullptr && + (reinterpret_cast<std::uintptr_t>(data) % alignof(SerializedNode)) != 0) { + this->owned_.resize((size + sizeof(std::uint64_t) - 1) / </file context>

Suggested change

if (data != nullptr &&

(reinterpret_cast<std::uintptr_t>(data) % alignof(SerializedNode)) != 0) {

this->owned_.resize((size + sizeof(std::uint64_t) - 1) /

sizeof(std::uint64_t));

if (data != nullptr && size > 0 &&

(reinterpret_cast<std::uintptr_t>(data) % alignof(SerializedNode)) != 0) {

this->owned_.resize(size / sizeof(std::uint64_t) +

(size % sizeof(std::uint64_t) != 0));

github-actions

Benchmark (linux/llvm)

Details

Benchmark suite	Current: `d1a74c1`	Previous: `0847c71`	Ratio
`Regex_Lower_S_Or_Upper_S_Asterisk`	`2.822875984275557` ns/iter	`2.832483112953622` ns/iter	`1.00`
`Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar`	`2.820227715601403` ns/iter	`2.803783515524918` ns/iter	`1.01`
`Regex_Period_Asterisk`	`2.4644432084654335` ns/iter	`2.4918542323749175` ns/iter	`0.99`
`Regex_Group_Period_Asterisk_Group`	`2.4624556585742425` ns/iter	`2.4910833645404926` ns/iter	`0.99`
`Regex_Period_Plus`	`4.222249790324824` ns/iter	`3.423465993939036` ns/iter	`1.23`
`Regex_Period`	`4.220407558130913` ns/iter	`3.425419947304121` ns/iter	`1.23`
`Regex_Caret_Period_Plus_Dollar`	`3.8684032023078894` ns/iter	`3.114289415945578` ns/iter	`1.24`
`Regex_Caret_Group_Period_Plus_Group_Dollar`	`3.870067575169871` ns/iter	`3.115318652054021` ns/iter	`1.24`
`Regex_Caret_Period_Asterisk_Dollar`	`2.8184332044534806` ns/iter	`4.050275234955937` ns/iter	`0.70`
`Regex_Caret_Group_Period_Asterisk_Group_Dollar`	`2.813484614040015` ns/iter	`4.046241835397155` ns/iter	`0.70`
`Regex_Caret_X_Hyphen`	`7.03420035817459` ns/iter	`7.174831225051941` ns/iter	`0.98`
`Regex_Period_Md_Dollar`	`26.0845048737636` ns/iter	`28.310456926800303` ns/iter	`0.92`
`Regex_Caret_Slash_Period_Asterisk`	`7.659941835745748` ns/iter	`6.537201564526791` ns/iter	`1.17`
`Regex_Caret_Period_Range_Dollar`	`3.166554944764974` ns/iter	`3.424492003666277` ns/iter	`0.92`
`Regex_Nested_Backtrack`	`38.240372869749` ns/iter	`38.94404687180287` ns/iter	`0.98`
`JSON_Array_Of_Objects_Unique`	`470.1233961893243` ns/iter	`407.53683321793096` ns/iter	`1.15`
`JSON_Parse_1`	`4646.574062831681` ns/iter	`4877.228346622248` ns/iter	`0.95`
`JSON_Parse_Real`	`5338.264870803861` ns/iter	`5333.13381622655` ns/iter	`1.00`
`JSON_Parse_Decimal`	`7517.2596669131235` ns/iter	`7639.478887508034` ns/iter	`0.98`
`JSON_Parse_Schema_ISO_Language`	`3497589.356784237` ns/iter	`3569074.16326519` ns/iter	`0.98`
`JSON_Parse_Integer`	`4055.9643821548184` ns/iter	`3633.772018772283` ns/iter	`1.12`
`JSON_Parse_String_NonSSO_Plain`	`5034.147180000446` ns/iter	`5079.699190471636` ns/iter	`0.99`
`JSON_Parse_String_SSO_Plain`	`2840.4098842939943` ns/iter	`2794.643557651719` ns/iter	`1.02`
`JSON_Parse_String_Escape_Heavy`	`14132.910721121594` ns/iter	`14408.335097870831` ns/iter	`0.98`
`JSON_Parse_Object_Short_Keys`	`7936.504231016826` ns/iter	`7693.8086020801975` ns/iter	`1.03`
`JSON_Parse_Object_Scalar_Properties`	`4010.055487144815` ns/iter	`3983.586498130086` ns/iter	`1.01`
`JSON_Parse_Object_Array_Properties`	`5508.096813629419` ns/iter	`5781.046397723433` ns/iter	`0.95`
`JSON_Parse_Object_Object_Properties`	`5516.185400115116` ns/iter	`5766.607093808748` ns/iter	`0.96`
`JSON_Parse_Nested_Containers`	`44857.9646775322` ns/iter	`44915.34638593265` ns/iter	`1.00`
`JSON_From_String_Copy`	`22.949742276549603` ns/iter	`20.245421007875827` ns/iter	`1.13`
`JSON_From_String_Temporary`	`22.839617851427153` ns/iter	`18.39701664548636` ns/iter	`1.24`
`JSON_Number_To_Double`	`25.950137175135676` ns/iter	`23.7370813043747` ns/iter	`1.09`
`JSON_Object_At_Last_Key/8`	`6.687689764779552` ns/iter	`5.9196686883562295` ns/iter	`1.13`
`JSON_Object_At_Last_Key/32`	`23.947413979569014` ns/iter	`21.808988033426672` ns/iter	`1.10`
`JSON_Object_At_Last_Key/128`	`91.5472064403627` ns/iter	`87.75605888508298` ns/iter	`1.04`
`JSON_Object_At_Last_Key/512`	`381.05052270532053` ns/iter	`402.15175337464404` ns/iter	`0.95`
`JSON_Fast_Hash_Helm_Chart_Lock`	`79.2272552420781` ns/iter	`57.89910497322281` ns/iter	`1.37`
`JSON_Equality_Helm_Chart_Lock`	`164.43198849298608` ns/iter	`161.96084072946013` ns/iter	`1.02`
`JSON_Divisible_By_Decimal`	`253.40535242278995` ns/iter	`242.46069114352005` ns/iter	`1.05`
`JSON_String_Equal/10`	`5.628873410353121` ns/iter	`5.610708335906291` ns/iter	`1.00`
`JSON_String_Equal/100`	`6.360762117635671` ns/iter	`6.238237168612241` ns/iter	`1.02`
`JSON_String_Equal_Small_By_Perfect_Hash/10`	`1.0574043184514885` ns/iter	`0.9359862158851563` ns/iter	`1.13`
`JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10`	`12.476537098168034` ns/iter	`14.620047249074862` ns/iter	`0.85`
`JSON_String_Fast_Hash/10`	`2.814383123048896` ns/iter	`2.49140172416419` ns/iter	`1.13`
`JSON_String_Fast_Hash/100`	`2.8170181334225326` ns/iter	`2.490960227095622` ns/iter	`1.13`
`JSON_String_Key_Hash/10`	`2.8166189022458785` ns/iter	`2.8440094136178145` ns/iter	`0.99`
`JSON_String_Key_Hash/100`	`8.08885038896526` ns/iter	`9.026192272786753` ns/iter	`0.90`
`JSON_Object_Defines_Miss_Same_Length`	`2.9535126174884025` ns/iter	`2.624908531889757` ns/iter	`1.13`
`JSON_Object_Defines_Miss_Too_Small`	`2.9416424399296135` ns/iter	`2.6759426804924575` ns/iter	`1.10`
`JSON_Object_Defines_Miss_Too_Large`	`3.2150561727413054` ns/iter	`2.8557768425257506` ns/iter	`1.13`
`Pointer_Object_Traverse`	`30.759272327415687` ns/iter	`28.783408957653293` ns/iter	`1.07`
`Pointer_Object_Try_Traverse`	`33.13583158206873` ns/iter	`31.200144196268884` ns/iter	`1.06`
`Pointer_Push_Back_Pointer_To_Weak_Pointer`	`185.32047875999746` ns/iter	`226.576421294845` ns/iter	`0.82`
`Pointer_Walker_Schema_ISO_Language`	`2749282.830708541` ns/iter	`2691906.5576923736` ns/iter	`1.02`
`Pointer_Maybe_Tracked_Deeply_Nested/0`	`1268018.1663651075` ns/iter	`1275960.544464484` ns/iter	`0.99`
`Pointer_Maybe_Tracked_Deeply_Nested/1`	`1578055.4826790064` ns/iter	`1563547.2879463716` ns/iter	`1.01`
`Pointer_Position_Tracker_Get_Deeply_Nested`	`782.7488746525488` ns/iter	`687.7959254254947` ns/iter	`1.14`
`URITemplateRouter_Create`	`30005.283606347282` ns/iter	`32539.52613757469` ns/iter	`0.92`
`URITemplateRouter_Match`	`183.7114137488894` ns/iter	`179.43317764671187` ns/iter	`1.02`
`URITemplateRouter_Match_BasePath`	`219.8867945423311` ns/iter	`211.0541188644845` ns/iter	`1.04`
`URITemplateRouterView_Restore`	`9817.153532065793` ns/iter	`8260.247587231232` ns/iter	`1.19`
`URITemplateRouterView_Match`	`145.1711610422639` ns/iter	`141.89547457580034` ns/iter	`1.02`
`URITemplateRouterView_Match_BasePath`	`165.11978437434394` ns/iter	`162.3658616674589` ns/iter	`1.02`
`URITemplateRouterView_Arguments`	`450.1188163816235` ns/iter	`421.416474577074` ns/iter	`1.07`
`JSONL_Parse_Large`	`8837465.734176522` ns/iter	`9702260.014084369` ns/iter	`0.91`
`JSONL_Parse_Large_GZIP`	`10589575.33333362` ns/iter	`11254628.080645224` ns/iter	`0.94`
`HTML_Build_Table_100000`	`73266135.40000153` ns/iter	`67814076.99999136` ns/iter	`1.08`
`HTML_Render_Table_100000`	`4839497.296551724` ns/iter	`5314063.061538177` ns/iter	`0.91`
`GZIP_Compress_ISO_Language_Set_3_Locations`	`35918944.89473864` ns/iter	`32386593.409088705` ns/iter	`1.11`
`GZIP_Decompress_ISO_Language_Set_3_Locations`	`4260359.4573169695` ns/iter	`4100171.6666668686` ns/iter	`1.04`
`GZIP_Compress_ISO_Language_Set_3_Schema`	`2135947.137195056` ns/iter	`1852371.8174603668` ns/iter	`1.15`
`GZIP_Decompress_ISO_Language_Set_3_Schema`	`277264.4059366285` ns/iter	`357886.1278118668` ns/iter	`0.77`
`JOSE_VerifySignature_RS256`	`63753.93966693195` ns/iter	`57044.64947282741` ns/iter	`1.12`
`JOSE_VerifySignature_ES512`	`2671187.2900764216` ns/iter	`2415052.534482537` ns/iter	`1.11`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

Benchmark (macos/llvm)

Details

Benchmark suite	Current: `d1a74c1`	Previous: `0847c71`	Ratio
`Regex_Lower_S_Or_Upper_S_Asterisk`	`1.8296944131016184` ns/iter	`1.8279636774228951` ns/iter	`1.00`
`Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar`	`1.7853212823536373` ns/iter	`1.7433875341237546` ns/iter	`1.02`
`Regex_Period_Asterisk`	`1.7211840828881924` ns/iter	`1.7351261442251877` ns/iter	`0.99`
`Regex_Group_Period_Asterisk_Group`	`1.7580455798668666` ns/iter	`2.159455942175183` ns/iter	`0.81`
`Regex_Period_Plus`	`2.5493546178466033` ns/iter	`2.20552380803926` ns/iter	`1.16`
`Regex_Period`	`2.414904941738995` ns/iter	`2.0738971234580466` ns/iter	`1.16`
`Regex_Caret_Period_Plus_Dollar`	`2.2811222491803074` ns/iter	`2.21008212714555` ns/iter	`1.03`
`Regex_Caret_Group_Period_Plus_Group_Dollar`	`2.2747477728507226` ns/iter	`2.2586001265290196` ns/iter	`1.01`
`Regex_Caret_Period_Asterisk_Dollar`	`1.919738593031332` ns/iter	`1.8662233769286543` ns/iter	`1.03`
`Regex_Caret_Group_Period_Asterisk_Group_Dollar`	`1.9175548804130251` ns/iter	`1.7369738033435889` ns/iter	`1.10`
`Regex_Caret_X_Hyphen`	`6.673639075140277` ns/iter	`6.117704587899747` ns/iter	`1.09`
`Regex_Period_Md_Dollar`	`18.534217479211062` ns/iter	`17.126972359209102` ns/iter	`1.08`
`Regex_Caret_Slash_Period_Asterisk`	`4.450092175323046` ns/iter	`5.7872018215160095` ns/iter	`0.77`
`Regex_Caret_Period_Range_Dollar`	`2.1795434365751287` ns/iter	`2.0044431226023223` ns/iter	`1.09`
`Regex_Nested_Backtrack`	`28.58432116248076` ns/iter	`25.815154178651166` ns/iter	`1.11`
`JSON_Array_Of_Objects_Unique`	`373.52692354740714` ns/iter	`350.5607801656491` ns/iter	`1.07`
`JSON_Parse_1`	`8078.253537622654` ns/iter	`6871.815478279291` ns/iter	`1.18`
`JSON_Parse_Real`	`8349.50858537545` ns/iter	`8642.158821979436` ns/iter	`0.97`
`JSON_Parse_Decimal`	`10134.436098391569` ns/iter	`8314.90156996123` ns/iter	`1.22`
`JSON_Parse_Schema_ISO_Language`	`4211270.242857219` ns/iter	`4297751.0921060145` ns/iter	`0.98`
`JSON_Parse_Integer`	`4612.6968514968075` ns/iter	`4885.395854146537` ns/iter	`0.94`
`JSON_Parse_String_NonSSO_Plain`	`7787.526829320587` ns/iter	`7975.698121451226` ns/iter	`0.98`
`JSON_Parse_String_SSO_Plain`	`2994.2848446359794` ns/iter	`3139.6548224634653` ns/iter	`0.95`
`JSON_Parse_String_Escape_Heavy`	`22918.25957363785` ns/iter	`23120.522785871923` ns/iter	`0.99`
`JSON_Parse_Object_Short_Keys`	`8561.305044468643` ns/iter	`8155.857593602654` ns/iter	`1.05`
`JSON_Parse_Object_Scalar_Properties`	`4542.405083268562` ns/iter	`4340.709099072131` ns/iter	`1.05`
`JSON_Parse_Object_Array_Properties`	`7086.375348176504` ns/iter	`7247.657355928521` ns/iter	`0.98`
`JSON_Parse_Object_Object_Properties`	`7639.0025413548765` ns/iter	`7905.885008624489` ns/iter	`0.97`
`JSON_Parse_Nested_Containers`	`68099.93403694253` ns/iter	`70458.53421980611` ns/iter	`0.97`
`JSON_From_String_Copy`	`25.811274815982845` ns/iter	`34.146943624450955` ns/iter	`0.76`
`JSON_From_String_Temporary`	`28.097136954581618` ns/iter	`28.72087845897283` ns/iter	`0.98`
`JSON_Number_To_Double`	`43.92702397989545` ns/iter	`40.00178421583221` ns/iter	`1.10`
`JSON_Object_At_Last_Key/8`	`4.206129433248038` ns/iter	`4.558137854284088` ns/iter	`0.92`
`JSON_Object_At_Last_Key/32`	`12.69637609976121` ns/iter	`12.690959567396405` ns/iter	`1.00`
`JSON_Object_At_Last_Key/128`	`55.864393679071675` ns/iter	`58.68909765330215` ns/iter	`0.95`
`JSON_Object_At_Last_Key/512`	`210.63453666936633` ns/iter	`186.89848989087997` ns/iter	`1.13`
`JSON_Fast_Hash_Helm_Chart_Lock`	`64.59631254939376` ns/iter	`58.37690501166029` ns/iter	`1.11`
`JSON_Equality_Helm_Chart_Lock`	`148.1518408194471` ns/iter	`137.2203106071627` ns/iter	`1.08`
`JSON_Divisible_By_Decimal`	`185.35284056628467` ns/iter	`179.03293899159476` ns/iter	`1.04`
`JSON_String_Equal/10`	`7.82617883419701` ns/iter	`6.577330848066971` ns/iter	`1.19`
`JSON_String_Equal/100`	`7.214099320702827` ns/iter	`6.494296080518912` ns/iter	`1.11`
`JSON_String_Equal_Small_By_Perfect_Hash/10`	`0.35508684075275887` ns/iter	`0.340201284534385` ns/iter	`1.04`
`JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10`	`3.5385748129538492` ns/iter	`3.5627140693564896` ns/iter	`0.99`
`JSON_String_Fast_Hash/10`	`2.8552178102032406` ns/iter	`3.095296128960583` ns/iter	`0.92`
`JSON_String_Fast_Hash/100`	`2.2001940152090804` ns/iter	`2.027258508984255` ns/iter	`1.09`
`JSON_String_Key_Hash/10`	`1.789754703925647` ns/iter	`1.6786749383874984` ns/iter	`1.07`
`JSON_String_Key_Hash/100`	`2.576689845001069` ns/iter	`2.245384898333329` ns/iter	`1.15`
`JSON_Object_Defines_Miss_Same_Length`	`2.7463170106550856` ns/iter	`2.715125017099582` ns/iter	`1.01`
`JSON_Object_Defines_Miss_Too_Small`	`2.70165540200648` ns/iter	`2.779874826208444` ns/iter	`0.97`
`JSON_Object_Defines_Miss_Too_Large`	`2.7233346843643544` ns/iter	`2.8958018617462282` ns/iter	`0.94`
`Pointer_Object_Traverse`	`26.214979534300813` ns/iter	`24.205642087664113` ns/iter	`1.08`
`Pointer_Object_Try_Traverse`	`25.032679339846858` ns/iter	`24.008289921826556` ns/iter	`1.04`
`Pointer_Push_Back_Pointer_To_Weak_Pointer`	`209.77727128966552` ns/iter	`181.74640721008902` ns/iter	`1.15`
`Pointer_Walker_Schema_ISO_Language`	`3371794.52451125` ns/iter	`2616029.017857662` ns/iter	`1.29`
`Pointer_Maybe_Tracked_Deeply_Nested/0`	`1369072.3392860563` ns/iter	`1374443.2533331702` ns/iter	`1.00`
`Pointer_Maybe_Tracked_Deeply_Nested/1`	`1361375.3955696607` ns/iter	`995606.1741007512` ns/iter	`1.37`
`Pointer_Position_Tracker_Get_Deeply_Nested`	`369.2701065819185` ns/iter	`328.9638035446924` ns/iter	`1.12`
`URITemplateRouter_Create`	`24969.88868207262` ns/iter	`22886.52600178488` ns/iter	`1.09`
`URITemplateRouter_Match`	`177.44640694999498` ns/iter	`170.83076342454927` ns/iter	`1.04`
`URITemplateRouter_Match_BasePath`	`208.65790228819668` ns/iter	`188.37939976279168` ns/iter	`1.11`
`URITemplateRouterView_Restore`	`11465.407378261189` ns/iter	`9863.25069565962` ns/iter	`1.16`
`URITemplateRouterView_Match`	`142.02578641849468` ns/iter	`137.10849348511343` ns/iter	`1.04`
`URITemplateRouterView_Match_BasePath`	`155.9062447490067` ns/iter	`163.97406312447177` ns/iter	`0.95`
`URITemplateRouterView_Arguments`	`562.3499857585454` ns/iter	`526.1869076722365` ns/iter	`1.07`
`JSONL_Parse_Large`	`11668172.131148972` ns/iter	`11366690.384612901` ns/iter	`1.03`
`JSONL_Parse_Large_GZIP`	`12744638.636368936` ns/iter	`10582525.000000505` ns/iter	`1.20`
`HTML_Build_Table_100000`	`42298468.17647473` ns/iter	`36448508.350008525` ns/iter	`1.16`
`HTML_Render_Table_100000`	`2235234.5195539473` ns/iter	`1739469.0802920705` ns/iter	`1.29`
`GZIP_Compress_ISO_Language_Set_3_Locations`	`35762772.8999887` ns/iter	`26089345.666672736` ns/iter	`1.37`
`GZIP_Decompress_ISO_Language_Set_3_Locations`	`3285187.707919843` ns/iter	`3117572.5409091436` ns/iter	`1.05`
`GZIP_Compress_ISO_Language_Set_3_Schema`	`1567064.7649665247` ns/iter	`1559738.2623655582` ns/iter	`1.00`
`GZIP_Decompress_ISO_Language_Set_3_Schema`	`293929.44172267977` ns/iter	`301265.8829060199` ns/iter	`0.98`
`JOSE_VerifySignature_RS256`	`24029.481403416732` ns/iter	`23072.13182972444` ns/iter	`1.04`
`JOSE_VerifySignature_ES512`	`1211906.554216889` ns/iter	`1164047.6391229122` ns/iter	`1.04`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

Benchmark (windows/msvc)

Details

Benchmark suite	Current: `d1a74c1`	Previous: `0847c71`	Ratio
`Regex_Lower_S_Or_Upper_S_Asterisk`	`5.068372999999156` ns/iter	`5.04285089285718` ns/iter	`1.01`
`Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar`	`5.013334000000214` ns/iter	`5.037374107144744` ns/iter	`1.00`
`Regex_Period_Asterisk`	`5.011936999999307` ns/iter	`5.040066999999908` ns/iter	`0.99`
`Regex_Group_Period_Asterisk_Group`	`5.015631000001122` ns/iter	`5.055403999999726` ns/iter	`0.99`
`Regex_Period_Plus`	`4.798440179642365` ns/iter	`4.795605201962531` ns/iter	`1.00`
`Regex_Period`	`4.797937121608674` ns/iter	`4.8122607142866105` ns/iter	`1.00`
`Regex_Caret_Period_Plus_Dollar`	`4.797860313570227` ns/iter	`4.7893232142866635` ns/iter	`1.00`
`Regex_Caret_Group_Period_Plus_Group_Dollar`	`4.800938170713551` ns/iter	`4.797974487676713` ns/iter	`1.00`
`Regex_Caret_Period_Asterisk_Dollar`	`5.018466999999873` ns/iter	`5.033300999998573` ns/iter	`1.00`
`Regex_Caret_Group_Period_Asterisk_Group_Dollar`	`5.009447077009392` ns/iter	`5.029477000000497` ns/iter	`1.00`
`Regex_Caret_X_Hyphen`	`8.240209784640559` ns/iter	`8.501334337046412` ns/iter	`0.97`
`Regex_Period_Md_Dollar`	`44.63011277114948` ns/iter	`44.22333750000007` ns/iter	`1.01`
`Regex_Caret_Slash_Period_Asterisk`	`7.834639508931422` ns/iter	`8.199109374998109` ns/iter	`0.96`
`Regex_Caret_Period_Range_Dollar`	`5.646367999997892` ns/iter	`5.693353571428719` ns/iter	`0.99`
`Regex_Nested_Backtrack`	`55.76903571429576` ns/iter	`55.47217857142073` ns/iter	`1.01`
`JSON_Array_Of_Objects_Unique`	`579.64482142836` ns/iter	`575.2226785714599` ns/iter	`1.01`
`JSON_Parse_1`	`8809.464689890086` ns/iter	`8971.671555037292` ns/iter	`0.98`
`JSON_Parse_Real`	`16103.5178571467` ns/iter	`15940.354910714153` ns/iter	`1.01`
`JSON_Parse_Decimal`	`11657.860937503983` ns/iter	`11780.837499998142` ns/iter	`0.99`
`JSON_Parse_Schema_ISO_Language`	`7266504.444442035` ns/iter	`8156408.000001345` ns/iter	`0.89`
`JSON_Parse_Integer`	`6061.044000002767` ns/iter	`6151.908928572425` ns/iter	`0.99`
`JSON_Parse_String_NonSSO_Plain`	`7709.4598214243` ns/iter	`7784.350446427319` ns/iter	`0.99`
`JSON_Parse_String_SSO_Plain`	`3746.3842028850236` ns/iter	`3741.435818864655` ns/iter	`1.00`
`JSON_Parse_String_Escape_Heavy`	`21787.580523483266` ns/iter	`21748.28749999591` ns/iter	`1.00`
`JSON_Parse_Object_Short_Keys`	`13157.414285712679` ns/iter	`13301.364056407821` ns/iter	`0.99`
`JSON_Parse_Object_Scalar_Properties`	`6791.514508930975` ns/iter	`6824.505357142487` ns/iter	`1.00`
`JSON_Parse_Object_Array_Properties`	`11212.542187500674` ns/iter	`11419.548214283688` ns/iter	`0.98`
`JSON_Parse_Object_Object_Properties`	`11468.759960895693` ns/iter	`11537.730357141689` ns/iter	`0.99`
`JSON_Parse_Nested_Containers`	`79169.25892853248` ns/iter	`80399.29687499686` ns/iter	`0.98`
`JSON_From_String_Copy`	`64.27518749997522` ns/iter	`65.25524000001042` ns/iter	`0.98`
`JSON_From_String_Temporary`	`58.566821428606936` ns/iter	`57.88608035715015` ns/iter	`1.01`
`JSON_Number_To_Double`	`121.9015357142845` ns/iter	`119.46217857143891` ns/iter	`1.02`
`JSON_Object_At_Last_Key/8`	`7.535411830359757` ns/iter	`7.540222098216175` ns/iter	`1.00`
`JSON_Object_At_Last_Key/32`	`22.930184374999385` ns/iter	`23.042229653541877` ns/iter	`1.00`
`JSON_Object_At_Last_Key/128`	`89.20437994623232` ns/iter	`90.05913883663976` ns/iter	`0.99`
`JSON_Object_At_Last_Key/512`	`423.04212499999494` ns/iter	`424.5823587517996` ns/iter	`1.00`
`JSON_Fast_Hash_Helm_Chart_Lock`	`104.9202542446064` ns/iter	`102.31254687496971` ns/iter	`1.03`
`JSON_Equality_Helm_Chart_Lock`	`210.73808657409535` ns/iter	`217.24798137284267` ns/iter	`0.97`
`JSON_Divisible_By_Decimal`	`295.7260183341914` ns/iter	`295.51358055740684` ns/iter	`1.00`
`JSON_String_Equal/10`	`10.339362500005223` ns/iter	`10.67327031250187` ns/iter	`0.97`
`JSON_String_Equal/100`	`11.627412500004652` ns/iter	`11.936570312499839` ns/iter	`0.97`
`JSON_String_Equal_Small_By_Perfect_Hash/10`	`2.507397142856657` ns/iter	`2.5283496428569054` ns/iter	`0.99`
`JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10`	`15.027524553577873` ns/iter	`15.020766897228421` ns/iter	`1.00`
`JSON_String_Fast_Hash/10`	`6.585301785715306` ns/iter	`6.588245535713863` ns/iter	`1.00`
`JSON_String_Fast_Hash/100`	`6.58353303571094` ns/iter	`6.592086607142278` ns/iter	`1.00`
`JSON_String_Key_Hash/10`	`5.338361999997687` ns/iter	`5.344066000000112` ns/iter	`1.00`
`JSON_String_Key_Hash/100`	`11.883137500002963` ns/iter	`11.933444642855711` ns/iter	`1.00`
`JSON_Object_Defines_Miss_Same_Length`	`4.710638849798602` ns/iter	`4.741749854427582` ns/iter	`0.99`
`JSON_Object_Defines_Miss_Too_Small`	`4.709354621586619` ns/iter	`4.836449999999104` ns/iter	`0.97`
`JSON_Object_Defines_Miss_Too_Large`	`4.701225010493869` ns/iter	`4.728299340911378` ns/iter	`0.99`
`Pointer_Object_Traverse`	`70.21716517857816` ns/iter	`70.18998214285992` ns/iter	`1.00`
`Pointer_Object_Try_Traverse`	`70.96570312497313` ns/iter	`71.44902901785599` ns/iter	`0.99`
`Pointer_Push_Back_Pointer_To_Weak_Pointer`	`164.38696428571527` ns/iter	`160.55158482143182` ns/iter	`1.02`
`Pointer_Walker_Schema_ISO_Language`	`10911831.249998728` ns/iter	`11700541.071426025` ns/iter	`0.93`
`Pointer_Maybe_Tracked_Deeply_Nested/0`	`2315371.5909099006` ns/iter	`2467192.7710843086` ns/iter	`0.94`
`Pointer_Maybe_Tracked_Deeply_Nested/1`	`3585403.0769209764` ns/iter	`3768937.4301677244` ns/iter	`0.95`
`Pointer_Position_Tracker_Get_Deeply_Nested`	`551.9775669645201` ns/iter	`596.3953125000135` ns/iter	`0.93`
`URITemplateRouter_Create`	`39803.11941964893` ns/iter	`40162.03354418933` ns/iter	`0.99`
`URITemplateRouter_Match`	`233.18210567166363` ns/iter	`232.84457222718` ns/iter	`1.00`
`URITemplateRouter_Match_BasePath`	`265.0301636174186` ns/iter	`265.2708198782189` ns/iter	`1.00`
`URITemplateRouterView_Restore`	`32300.593750014577` ns/iter	`32256.480570011914` ns/iter	`1.00`
`URITemplateRouterView_Match`	`181.79856980348353` ns/iter	`180.95034651344608` ns/iter	`1.00`
`URITemplateRouterView_Match_BasePath`	`205.08732343359233` ns/iter	`205.63903992678217` ns/iter	`1.00`
`URITemplateRouterView_Arguments`	`534.7763999998278` ns/iter	`532.8712000000451` ns/iter	`1.00`
`JSONL_Parse_Large`	`32539552.38096751` ns/iter	`32929990.476196464` ns/iter	`0.99`
`JSONL_Parse_Large_GZIP`	`33233000.00000104` ns/iter	`33585438.09523932` ns/iter	`0.99`
`HTML_Build_Table_100000`	`87159022.22224435` ns/iter	`90657314.28573339` ns/iter	`0.96`
`HTML_Render_Table_100000`	`6960037.777778578` ns/iter	`8121361.333332971` ns/iter	`0.86`
`GZIP_Compress_ISO_Language_Set_3_Locations`	`36368300.00000133` ns/iter	`35897426.315793715` ns/iter	`1.01`
`GZIP_Decompress_ISO_Language_Set_3_Locations`	`9382361.333330967` ns/iter	`10398004.687502293` ns/iter	`0.90`
`GZIP_Compress_ISO_Language_Set_3_Schema`	`2113107.8260860583` ns/iter	`2103513.6729221204` ns/iter	`1.00`
`GZIP_Decompress_ISO_Language_Set_3_Schema`	`612843.7499999758` ns/iter	`654516.0714283936` ns/iter	`0.94`
`JOSE_VerifySignature_RS256`	`21161.078125004453` ns/iter	`21257.425570195926` ns/iter	`1.00`
`JOSE_VerifySignature_ES512`	`1540017.4107144591` ns/iter	`1535618.9732145255` ns/iter	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

Benchmark (linux/gcc)

Details

Benchmark suite	Current: `d1a74c1`	Previous: `0847c71`	Ratio
`JOSE_VerifySignature_RS256`	`22427.519375687723` ns/iter	`22204.06445064742` ns/iter	`1.01`
`JOSE_VerifySignature_ES512`	`576101.0272727836` ns/iter	`577700.534710748` ns/iter	`1.00`
`GZIP_Compress_ISO_Language_Set_3_Locations`	`45264697.87500531` ns/iter	`36271141.89474038` ns/iter	`1.25`
`GZIP_Decompress_ISO_Language_Set_3_Locations`	`4111254.947058703` ns/iter	`4291689.60240997` ns/iter	`0.96`
`GZIP_Compress_ISO_Language_Set_3_Schema`	`2319905.215946705` ns/iter	`2015033.6051870983` ns/iter	`1.15`
`GZIP_Decompress_ISO_Language_Set_3_Schema`	`378656.31260139664` ns/iter	`376648.0290635116` ns/iter	`1.01`
`HTML_Build_Table_100000`	`60739235.1818238` ns/iter	`59567987.41667058` ns/iter	`1.02`
`HTML_Render_Table_100000`	`1998799.565341032` ns/iter	`1802510.1979164404` ns/iter	`1.11`
`JSONL_Parse_Large`	`12976713.537038146` ns/iter	`13089015.075470857` ns/iter	`0.99`
`JSONL_Parse_Large_GZIP`	`14513947.416666895` ns/iter	`14483978.104166796` ns/iter	`1.00`
`URITemplateRouter_Create`	`30813.65990249037` ns/iter	`30914.187196255898` ns/iter	`1.00`
`URITemplateRouter_Match`	`148.35057458933582` ns/iter	`153.79507500955737` ns/iter	`0.96`
`URITemplateRouter_Match_BasePath`	`169.89185936338197` ns/iter	`179.5536233526805` ns/iter	`0.95`
`URITemplateRouterView_Restore`	`8648.553698342812` ns/iter	`8570.576608970016` ns/iter	`1.01`
`URITemplateRouterView_Match`	`123.58874147774581` ns/iter	`123.6067634663834` ns/iter	`1.00`
`URITemplateRouterView_Match_BasePath`	`145.69135050524534` ns/iter	`145.88987919017427` ns/iter	`1.00`
`URITemplateRouterView_Arguments`	`480.32632609360337` ns/iter	`468.8616644845639` ns/iter	`1.02`
`Pointer_Object_Traverse`	`31.040824919914154` ns/iter	`31.18438623525577` ns/iter	`1.00`
`Pointer_Object_Try_Traverse`	`23.12826230389572` ns/iter	`23.032287769072177` ns/iter	`1.00`
`Pointer_Push_Back_Pointer_To_Weak_Pointer`	`148.43392412480475` ns/iter	`157.84549746159698` ns/iter	`0.94`
`Pointer_Walker_Schema_ISO_Language`	`2768151.867187374` ns/iter	`2781164.5000000447` ns/iter	`1.00`
`Pointer_Maybe_Tracked_Deeply_Nested/0`	`1874831.286486492` ns/iter	`1890714.2679559404` ns/iter	`0.99`
`Pointer_Maybe_Tracked_Deeply_Nested/1`	`1678389.604316719` ns/iter	`1680859.1339712115` ns/iter	`1.00`
`Pointer_Position_Tracker_Get_Deeply_Nested`	`561.3851438737939` ns/iter	`616.3201857272328` ns/iter	`0.91`
`JSON_Array_Of_Objects_Unique`	`447.68154617067347` ns/iter	`434.44853394556554` ns/iter	`1.03`
`JSON_Parse_1`	`9754.22784739499` ns/iter	`9424.493872237199` ns/iter	`1.03`
`JSON_Parse_Real`	`7714.597433618325` ns/iter	`7705.869195625113` ns/iter	`1.00`
`JSON_Parse_Decimal`	`12825.909960232628` ns/iter	`12764.157715057825` ns/iter	`1.00`
`JSON_Parse_Schema_ISO_Language`	`6412297.20909099` ns/iter	`6404491.605503984` ns/iter	`1.00`
`JSON_Parse_Integer`	`5743.651515400393` ns/iter	`5830.688979000553` ns/iter	`0.99`
`JSON_Parse_String_NonSSO_Plain`	`11788.919687720912` ns/iter	`12013.545983482692` ns/iter	`0.98`
`JSON_Parse_String_SSO_Plain`	`4887.8922679038` ns/iter	`4894.251404936777` ns/iter	`1.00`
`JSON_Parse_String_Escape_Heavy`	`24593.240222871227` ns/iter	`25127.172631206606` ns/iter	`0.98`
`JSON_Parse_Object_Short_Keys`	`16573.12250464266` ns/iter	`13348.242875487238` ns/iter	`1.24`
`JSON_Parse_Object_Scalar_Properties`	`7165.038570787003` ns/iter	`6760.18944096435` ns/iter	`1.06`
`JSON_Parse_Object_Array_Properties`	`11169.95960544039` ns/iter	`11104.110301340948` ns/iter	`1.01`
`JSON_Parse_Object_Object_Properties`	`11770.0413965674` ns/iter	`11260.823649484693` ns/iter	`1.05`
`JSON_Parse_Nested_Containers`	`98602.62432966546` ns/iter	`94792.8040805177` ns/iter	`1.04`
`JSON_From_String_Copy`	`18.07532992138637` ns/iter	`17.763858664222557` ns/iter	`1.02`
`JSON_From_String_Temporary`	`15.040370201471273` ns/iter	`15.340718969386858` ns/iter	`0.98`
`JSON_Number_To_Double`	`22.142607549388256` ns/iter	`22.143952861697297` ns/iter	`1.00`
`JSON_Object_At_Last_Key/8`	`3.741871427315621` ns/iter	`3.7525601182002237` ns/iter	`1.00`
`JSON_Object_At_Last_Key/32`	`12.655125611621365` ns/iter	`12.629517956970444` ns/iter	`1.00`
`JSON_Object_At_Last_Key/128`	`48.895660451876864` ns/iter	`48.90611040161755` ns/iter	`1.00`
`JSON_Object_At_Last_Key/512`	`360.56482847975417` ns/iter	`356.6732689391399` ns/iter	`1.01`
`JSON_Fast_Hash_Helm_Chart_Lock`	`71.10891035718936` ns/iter	`60.75746866124395` ns/iter	`1.17`
`JSON_Equality_Helm_Chart_Lock`	`160.4478046114292` ns/iter	`188.01332315902812` ns/iter	`0.85`
`JSON_Divisible_By_Decimal`	`241.43676494421854` ns/iter	`241.43446420157125` ns/iter	`1.00`
`JSON_String_Equal/10`	`5.688608286995685` ns/iter	`6.313515729666107` ns/iter	`0.90`
`JSON_String_Equal/100`	`6.313319996466875` ns/iter	`6.937962692162302` ns/iter	`0.91`
`JSON_String_Equal_Small_By_Perfect_Hash/10`	`0.7495806947817402` ns/iter	`0.7496640598982838` ns/iter	`1.00`
`JSON_String_Equal_Small_By_Runtime_Perfect_Hash/10`	`25.206923368945308` ns/iter	`25.196938086801136` ns/iter	`1.00`
`JSON_String_Fast_Hash/10`	`2.5771170251582975` ns/iter	`3.0548176603012753` ns/iter	`0.84`
`JSON_String_Fast_Hash/100`	`2.5694233981584156` ns/iter	`3.0005996502760466` ns/iter	`0.86`
`JSON_String_Key_Hash/10`	`1.5670220133371546` ns/iter	`1.5608351734542787` ns/iter	`1.00`
`JSON_String_Key_Hash/100`	`12.45034665180258` ns/iter	`12.447268696585693` ns/iter	`1.00`
`JSON_Object_Defines_Miss_Same_Length`	`3.1291977660961248` ns/iter	`3.114346996515096` ns/iter	`1.00`
`JSON_Object_Defines_Miss_Too_Small`	`2.8030904586775307` ns/iter	`2.802560169618649` ns/iter	`1.00`
`JSON_Object_Defines_Miss_Too_Large`	`2.801700443069891` ns/iter	`2.8042540255207937` ns/iter	`1.00`
`Regex_Lower_S_Or_Upper_S_Asterisk`	`0.9371976247342518` ns/iter	`0.9376942091957048` ns/iter	`1.00`
`Regex_Caret_Lower_S_Or_Upper_S_Asterisk_Dollar`	`0.9347161366083993` ns/iter	`0.9338970549412419` ns/iter	`1.00`
`Regex_Period_Asterisk`	`0.62271933080677` ns/iter	`0.62697734240627` ns/iter	`0.99`
`Regex_Group_Period_Asterisk_Group`	`0.6228851474262521` ns/iter	`0.6225556774029242` ns/iter	`1.00`
`Regex_Period_Plus`	`0.9364665712747187` ns/iter	`0.933905921197407` ns/iter	`1.00`
`Regex_Period`	`0.9343901793533029` ns/iter	`0.9540009247324018` ns/iter	`0.98`
`Regex_Caret_Period_Plus_Dollar`	`0.6226588589124971` ns/iter	`0.6231228160056452` ns/iter	`1.00`
`Regex_Caret_Group_Period_Plus_Group_Dollar`	`0.623025468301409` ns/iter	`0.623293618596089` ns/iter	`1.00`
`Regex_Caret_Period_Asterisk_Dollar`	`0.9360626787870427` ns/iter	`0.9381967814024598` ns/iter	`1.00`
`Regex_Caret_Group_Period_Asterisk_Group_Dollar`	`0.9414967329990472` ns/iter	`0.9339901183703753` ns/iter	`1.01`
`Regex_Caret_X_Hyphen`	`3.7380571437052437` ns/iter	`3.7375010686511825` ns/iter	`1.00`
`Regex_Period_Md_Dollar`	`32.091974945703846` ns/iter	`30.41746807010658` ns/iter	`1.06`
`Regex_Caret_Slash_Period_Asterisk`	`4.669394335301674` ns/iter	`4.668208382819649` ns/iter	`1.00`
`Regex_Caret_Period_Range_Dollar`	`1.5577381100012946` ns/iter	`1.5699575705520488` ns/iter	`0.99`
`Regex_Nested_Backtrack`	`40.14316185988577` ns/iter	`38.53561988925525` ns/iter	`1.04`

This comment was automatically generated by workflow using github-action-benchmark.

Fix a case of undefined behavior in URITemplateRouter

d1a74c1

Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>

augmentcode Bot reviewed Jul 7, 2026

View reviewed changes

cubic-dev-ai Bot reviewed Jul 7, 2026

View reviewed changes

github-actions Bot reviewed Jul 7, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Fix a case of undefined behavior in `URITemplateRouter`#2612

Fix a case of undefined behavior in `URITemplateRouter`#2612
jviotti wants to merge 1 commit into
mainfrom
uritemplate-ub

jviotti commented Jul 7, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

augmentcode Bot commented Jul 7, 2026

Uh oh!

augmentcode Bot left a comment

Uh oh!

augmentcode Bot Jul 7, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

cubic-dev-ai Bot Jul 7, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

jviotti commented Jul 7, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

augmentcode Bot commented Jul 7, 2026

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Benchmark (linux/llvm)

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Benchmark (macos/llvm)

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Benchmark (windows/msvc)

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Benchmark (linux/gcc)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jviotti commented Jul 7, 2026 •

edited by cubic-dev-ai Bot

Loading

augmentcode Bot Jul 7, 2026 •

edited

Loading