From dfc9e6a392eecc1d55e9d73c828fd944b753a8e0 Mon Sep 17 00:00:00 2001
From: Claude <claude@swactor.dev>
Date: Fri, 13 Feb 2026 08:26:57 +0000
Subject: [PATCH] fix: bounds-check alloc pointer before copy_from_slice

Guest alloc could return a pointer where ptr+len exceeds linear memory
size, causing a Rust panic that permanently poisoned the actor. Now
validates ptr+len <= memory.len() before writing, dropping the message
on OOB (consistent with other allocation failure handling).

Authored by Claude, lovingly guided by Zachery Aaron Shores-Chmielewski
---
 crates/wasm-actor/src/actor.rs        | 9 ++++++---
 crates/wasm-actor/tests/wasm_actor.rs | 1 -
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/crates/wasm-actor/src/actor.rs b/crates/wasm-actor/src/actor.rs
index 088ccf0..c9ba97e 100644
--- a/crates/wasm-actor/src/actor.rs
+++ b/crates/wasm-actor/src/actor.rs
@@ -41,9 +41,12 @@ impl ActorInterface for WasmActor {
         };
 
         // 2. Write message bytes into guest memory
-        self.memory.data_mut(&mut self.store)
-            [ptr as usize..(ptr as usize + bytes.len())]
-            .copy_from_slice(bytes);
+        let mem = self.memory.data_mut(&mut self.store);
+        let end = (ptr as usize).saturating_add(bytes.len());
+        if end > mem.len() {
+            return; // alloc returned OOB pointer — drop message
+        }
+        mem[ptr as usize..end].copy_from_slice(bytes);
 
         // 3. Call guest handle
         if self.handle.call(&mut self.store, (ptr, len)).is_err() {
diff --git a/crates/wasm-actor/tests/wasm_actor.rs b/crates/wasm-actor/tests/wasm_actor.rs
index de08c19..6322a0f 100644
--- a/crates/wasm-actor/tests/wasm_actor.rs
+++ b/crates/wasm-actor/tests/wasm_actor.rs
@@ -280,7 +280,6 @@ fn handle_trap_drops_message_actor_survives() {
 // ── Bounds safety: alloc pointer near end of linear memory ────────────────────
 
 #[test]
-#[ignore] // BUG: actor.rs:44-46 has no bounds check — actor gets poisoned instead of surviving
 fn alloc_near_end_of_memory_drops_message_actor_survives() {
     // Guest alloc returns 65500 (near end of 1-page / 65536-byte memory).
     // A 100-byte message means ptr+len = 65600, which exceeds memory bounds.