fix(commons): handle VLM raw-image allocation and size failures

[shubhamsinnh]

Description

Commons converted raw VLM image payloads without fully validating their dimensions or allocation results. Raw RGB copied through an unchecked allocation, while RGBA conversion multiplied width, height, and channel counts without guarding size_t overflow before writing the output buffer. On constrained builds, particularly 32-bit WASM, malformed or oversized dimensions could therefore produce an undersized allocation or a null-pointer write.

Validate positive dimensions and every byte-count multiplication before allocating. Require tightly packed RGB/RGBA payloads to exactly match their declared dimensions, return conversion failure when allocation fails, and publish the converted pixel buffer only after the copy or conversion succeeds.

The change stays at the shared Commons proto boundary and does not alter the public C ABI or protobuf schema.

Type of Change

• Bug fix
• New feature
• Documentation update
• Refactoring

Testing

• git diff --check
• Protobuf-enabled rac_proto_adapters.cpp compiled successfully to an object with GCC 16 and C++20
• Full Commons CMake build — dependency-only libarchive platform probes were timeboxed before project generation
• Repository clang-format gate — installed clang-format v12 cannot parse the current SortIncludes: CaseSensitive configuration
• Added/updated tests — not requested for this focused allocation and bounds-safety fix

Checklist

• Code follows project style guidelines
• Self-review completed
• No public API, ABI, or protobuf schema changes
• Documentation update not required

Screenshots

Not applicable; no UI changes.

Summary by CodeRabbit

• Bug Fixes
  • Improved validation for raw RGB and RGBA image data, rejecting mismatched dimensions or invalid payload sizes.
  • Prevented failures caused by image-size integer overflow and memory-allocation errors.
  • Correctly maps embedding input types and rejects unknown values.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 7383bc72-c7e3-4a5e-aa05-1e9c7af1e531

📥 Commits

Reviewing files that changed from the base of the PR and between 3cda803 and b483ceb.

📒 Files selected for processing (1)

• core/src/foundation/rac_proto_adapters.cpp

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The adapter adds overflow-safe image-size checks, validates RGB and RGBA payloads and allocations, and maps supported embedding input types from protobuf values.

Changes

Adapter conversion validation

Layer / File(s)	Summary
Checked image-size calculation core/src/foundation/rac_proto_adapters.cpp	Adds a helper that rejects invalid dimensions, zero bytes per pixel, null output pointers, and multiplication overflow.
Validated RGB and RGBA decoding core/src/foundation/rac_proto_adapters.cpp	RGB and RGBA paths require exact input sizes, check allocation results, and validate RGB output sizing before copying or conversion.
Embedding input type mapping core/src/foundation/rac_proto_adapters.cpp	Maps UNSPECIFIED, QUERY, and DOCUMENT values to the C input_type field and rejects unknown values.

Estimated code review effort: 2 (Simple) | ~15 minutes

Merge Risk: ⚪ Minimal · up to b483c

Raw image conversion now rejects invalid dimensions, malformed payload sizes, overflowed allocations, and unsupported embedding input types before publishing output buffers. No current merge-blocking risk is identified.

Suggested reviewers: sanchitmonga22

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the Commons VLM raw-image allocation and size-failure fix.
Description check	✅ Passed	The description clearly explains the bug, the safety changes, scope, testing status, and checklist results. It omits the template's Labels section and platform-specific checklist, but these omissions …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sanchitmonga22]

Thanks a lot for this, @shubhamsinnh! This closes a heap over-read/overflow in the VLM raw_rgb/raw_rgba proto adapter -- a malformed image with dimensions larger than (or overflowing against) the payload could over-read the heap, and a failed allocation could get written through silently.

Checked: CodeRabbit reviewed the latest commit · CI green · built and linted locally merged into main (core-cpp-commons) · two independent code reviews.

Follow-ups, not blocking: #893 (validating raw image size in the direct C-struct VLM entry points too), #894 (surfacing a specific error when raw image validation fails), #895 (test coverage for the new raw_rgb/raw_rgba checks) -- you're welcome to pick these up.

Merging now -- really appreciate the contribution!

Reviewed with help from Claude Code and Codex.