Lucene.Net.Support.VIntUtils: Fixed Debug.Assert to check for invalid VInt lengths, not requiring maximum lengths, which are in fact allowed for sources that don't change position on read.

Author: NightOwl888

src/Lucene.Net.Tests/Support/TestVIntUtils.cs

@@ -171,5 +171,93 @@ public void TestMaxLengths()
             assertEquals(VIntUtils.MaxVInt32Length, EncodeVInt32(-1).Length);
             assertEquals(VIntUtils.MaxVInt64Length, EncodeVInt64(long.MaxValue).Length);
         }
+
+#if DEBUG
+
+        [TestCase(0)]
+        [TestCase(1)]
+        [TestCase(127)]
+        [TestCase(128)]
+        [TestCase(16383)]
+        [TestCase(16384)]
+        [TestCase(2097151)]
+        [TestCase(2097152)]
+        [TestCase(268435455)]
+        [TestCase(int.MaxValue)]
+        [TestCase(-1)]
+        [LuceneNetSpecific]
+        public void TestReadVInt32_DebugAssertRequiresCompleteSpan(int value)
+        {
+            byte[] encoded = EncodeVInt32(value);
+
+            // Every prefix shorter than the encoded value should assert.
+            for (int length = 0; length < encoded.Length; length++)
+            {
+                Assert.Throws(Lucene.ExceptionExtensions.DebugAssertExceptionType, () =>
+                {
+                    VIntUtils.TryReadVInt32(encoded.AsSpan(0, length), out _, out _);
+                }, $"Expected {Lucene.ExceptionExtensions.DebugAssertExceptionType.AssemblyQualifiedName} for value {value} with span length {length}.");
+            }
+
+            // The exact encoded length should succeed.
+            {
+                Assert.DoesNotThrow(() =>
+                {
+                    bool ok = VIntUtils.TryReadVInt32(encoded, out int result, out int count);
+
+                    assertTrue(ok);
+                    assertEquals(value, result);
+                    assertEquals(encoded.Length, count);
+                });
+            }
+        }
+
+        [TestCase(0L)]
+        [TestCase(1L)]
+        [TestCase(127L)]
+        [TestCase(128L)]
+        [TestCase(16383L)]
+        [TestCase(16384L)]
+        [TestCase(2097151L)]
+        [TestCase(2097152L)]
+        [TestCase(268435455L)]
+        [TestCase(268435456L)]
+        [TestCase(34359738367L)]
+        [TestCase(34359738368L)]
+        [TestCase(4398046511103L)]
+        [TestCase(4398046511104L)]
+        [TestCase(562949953421311L)]
+        [TestCase(562949953421312L)]
+        [TestCase(72057594037927935L)]
+        [TestCase(72057594037927936L)]
+        [TestCase(long.MaxValue)]
+        [LuceneNetSpecific]
+        public void TestReadVInt64_DebugAssertRequiresCompleteSpan(long value)
+        {
+            byte[] encoded = EncodeVInt64(value);
+
+            // Every prefix shorter than the encoded value should assert.
+            for (int length = 0; length < encoded.Length; length++)
+            {
+                Assert.Throws(Lucene.ExceptionExtensions.DebugAssertExceptionType, () =>
+                {
+                    VIntUtils.TryReadVInt64(encoded.AsSpan(0, length), out _, out _);
+                }, $"Expected {Lucene.ExceptionExtensions.DebugAssertExceptionType.AssemblyQualifiedName} for value {value} with span length {length}.");
+            }
+
+            // The exact encoded length should succeed.
+            {
+                Assert.DoesNotThrow(() =>
+                {
+                    bool ok = VIntUtils.TryReadVInt64(encoded, out long result, out int count);
+
+                    assertTrue(ok);
+                    assertEquals(value, result);
+                    assertEquals(encoded.Length, count);
+                });
+            }
+        }
+
+#endif
     }
 }

src/Lucene.Net/Support/VIntUtils.cs

@@ -55,7 +55,7 @@ internal static class VIntUtils
         /// extra high bits set.</returns>
         public static bool TryReadVInt32(ReadOnlySpan<byte> source, out int value, out int count)
         {
-            Debug.Assert(source.Length >= 1);
+            AssertCanContainVInt32(source);
             byte b = source[0];
             if (b <= sbyte.MaxValue) // LUCENENET: Optimized equivalent of "if ((sbyte)b >= 0)"
             {
@@ -109,7 +109,7 @@ public static bool TryReadVInt32(ReadOnlySpan<byte> source, out int value, out i
         /// the continuation bit set (which would indicate a negative value, disallowed).</returns>
         public static bool TryReadVInt64(ReadOnlySpan<byte> source, out long value, out int count)
         {
-            Debug.Assert(source.Length >= 1);
+            AssertCanContainVInt64(source);
             byte b = source[0];
             if (b <= sbyte.MaxValue)
             {
@@ -181,6 +181,42 @@ public static bool TryReadVInt64(ReadOnlySpan<byte> source, out long value, out
             return b <= sbyte.MaxValue;
         }
 
+        [Conditional("DEBUG")]
+        private static void AssertCanContainVInt32(ReadOnlySpan<byte> source)
+        {
+            int length = source.Length;
+            if (length >= MaxVInt32Length) return;
+
+            int limit = Math.Min(length, MaxVInt32Length);
+
+            for (int i = 0; i < limit; i++)
+            {
+                if ((source[i] & 0x80) == 0)
+                    return;
+            }
+
+            Debug.Assert(length >= MaxVInt32Length,
+                "The span is too short to contain a complete VInt32.");
+        }
+
+        [Conditional("DEBUG")]
+        private static void AssertCanContainVInt64(ReadOnlySpan<byte> source)
+        {
+            int length = source.Length;
+            if (length >= MaxVInt64Length) return;
+
+            int limit = Math.Min(length, MaxVInt64Length);
+
+            for (int i = 0; i < limit; i++)
+            {
+                if ((source[i] & 0x80) == 0)
+                    return;
+            }
+
+            Debug.Assert(length >= MaxVInt64Length,
+                "The span is too short to contain a complete VInt64.");
+        }
+
         // LUCENENET: The throw sites below are factored into dedicated, non-inlined helpers so the
         // hot Read*VInt* overrides that call them stay small enough for the JIT to inline. Keeping
         // the `throw` + message string out of the caller body avoids bloating its IL (the inliner