mirror of
https://github.com/storytold/lightcraft.git
synced 2026-10-26 02:59:17 -06:00
midasmatterhorn
ea826b11cc
`version.*`, `pointColor.delete` and `redeye.catchlight`/`redeye.delete` parsed `index` with `f64_req(..)? as usize`. Rust's float-to-int cast saturates, so `index: -1` became 0 and the bounds checks never saw a negative: a caller sending `index: -1` silently deleted, restored or renamed version 0 (or the first point-colour sample / red-eye correction) and got `ok` back. `history.restore` already guards this and `spot_index` uses `as_u64`. New `index_req` helper in `cmd/mod.rs` (the same finite, non-negative guard) is used by the five sites. Behaviour for valid indices is unchanged. Regression test `negative_indices_are_refused` creates a version, then asserts `version.delete/restore/rename` with `index: -1` error and version 0 is untouched (before the fix the first one deletes it).