From 3f29eb2fa6298878674e8014d378615362e1dfdb Mon Sep 17 00:00:00 2001 From: Anand Krishnamoorthi Date: Fri, 19 Dec 2025 11:19:31 -0600 Subject: [PATCH] fix: Create ordered statements in a safe way Signed-off-by: Anand Krishnamoorthi --- src/interpreter.rs | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/src/interpreter.rs b/src/interpreter.rs index fe1974a..2e551f1 100644 --- a/src/interpreter.rs +++ b/src/interpreter.rs @@ -2063,7 +2063,30 @@ impl Interpreter { }; let ordered_stmts: Vec<&LiteralStmt> = match order_indices { - Some(order) => order.iter().map(|i| &query.stmts[*i as usize]).collect(), + Some(order) => { + let stmts_len = query.stmts.len(); + if order.len() != stmts_len { + let msg = format!( + "invalid schedule: expected {stmts_len} statement indices, found {}", + order.len() + ); + bail!(query.span.error(msg.as_str())); + } + + let mut ordered = Vec::with_capacity(stmts_len); + for idx in order { + let stmt_idx = *idx as usize; + if stmt_idx >= stmts_len { + let msg = format!( + "invalid schedule index {stmt_idx} for {} statements", + stmts_len + ); + bail!(query.span.error(msg.as_str())); + } + ordered.push(&query.stmts[stmt_idx]); + } + ordered + } None => query.stmts.iter().collect(), };