AMReX-Astro / AMReX-Astro/Microphysics

metal_chem parser OOB on blank/comment lines

Open
#1,943 0 comments 0 reactions 1 assignee View on GitHub

@BenWibking is already working on this.

Since Mar 3, 2026.

ai-code-audit
Dominant language
C++
Stars
43
Forks
46
Avg merge
2d 18h
Merged PRs (30d)
15

Description

metal_chem table parser can read out-of-bounds on blank/comment-only input

Summary

actual_network_init() in networks/metal_chem/actual_network_data.cpp assumes each scanned line has at least one character while skipping comments (line[0] != '#'). A blank line can trigger out-of-bounds access, and a comment-only/EOF file path gives weak validation behavior.

Severity

High

Affected Code

  • networks/metal_chem/actual_network_data.cpp
    • comment-skip loop around line 28
    • header validation around lines 35-36

Why This Is a Bug

  • Accessing line[0] when line.empty() is undefined behavior.
  • If the file has only comments or terminates before a data header, the current flow does not robustly detect that no header was found before checking format.
  • This is initialization-path code; failure can abort setup or silently misdiagnose malformed inputs.

Proposed Patch

Harden parsing by:

  1. Ignoring empty lines while scanning for header.
  2. Tracking whether a non-comment header line was found.
  3. Throwing a clear error if missing header before format checks.
--- a/networks/metal_chem/actual_network_data.cpp
+++ b/networks/metal_chem/actual_network_data.cpp
@@
-    // Skip comments and read until the first non-comment line
-    while (std::getline(file, line)) {
-        if (line[0] != '#') {
-            break;
-        }
-    }
+    // Skip comments/blank lines and read until the first data/header line
+    bool found_header = false;
+    while (std::getline(file, line)) {
+        if (line.empty()) {
+            continue;
+        }
+        if (line[0] == '#') {
+            continue;
+        }
+        found_header = true;
+        break;
+    }
+
+    if (!found_header) {
+        throw std::runtime_error("ERROR: file " + filename + " has no data/header line.");
+    }
@@
-    if (line.find(',') == std::string::npos) {
+    if (line.find(',') == std::string::npos) {
         throw std::runtime_error("ERROR: file " + filename + " should contain the number of rows and columns in the format 'RR, CC'");
     }

Validation

  • Run with a valid Semenov_PlanckOpacity.dat and confirm initialization still succeeds.
  • Add a blank line before the first non-comment line; ensure no crash.
  • Test a comment-only file and confirm clear exception message.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.