fix(oracle): guard SUBSTRB end boundary

[yyqdbngt]

Summary

• stop SUBSTRB from calling pg_mblen() after its scan pointer reaches the end of the varlena payload
• keep the existing byte-substring result unchanged
• exercise the exact-end UTF-8 boundary path in regression coverage

Why

When the requested byte range ends exactly at the source boundary, the loop advances subStrEnd to the one-past-end pointer. The old loop condition then evaluates pg_mblen(subStrEnd) before determining that another character cannot fit. Because a multibyte character length is always positive, this usually does not change the returned value; the defect is the out-of-bounds read itself, which depends on the adjacent memory layout and is not reliably observable in a normal result assertion.

The added regression case exercises this boundary and protects the expected result. Detecting the old read directly requires an instrumented memory-safety build.

Testing

• git diff --check
• the boundary regression preserves the complete UTF-8 result
• an independent aarch64 Linux verification reported the full oracle-check suite passing 28/28 with ENCODING=UTF8

Closes #1844

Assisted-by: OpenAI:GPT-5
Percentage of AI-generated code: 100%

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 73b46818-f48e-41dd-8b07-d47e27d97ad2

📥 Commits

Reviewing files that changed from the base of the PR and between 42ed378 and 1a43518.

📒 Files selected for processing (3)

• contrib/ivorysql_ora/expected/ora_character_datatype_functions.out
• contrib/ivorysql_ora/sql/ora_character_datatype_functions.sql
• contrib/ivorysql_ora/src/builtin_functions/character_datatype_functions.c

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The multibyte SUBSTRB loop now prevents boundary overrun during character traversal. Regression coverage verifies that a six-byte limit returns the complete UTF-8 string 你好.

Changes

SUBSTRB multibyte boundary handling

Layer / File(s)	Summary
Guard multibyte boundary traversal contrib/ivorysql_ora/src/builtin_functions/character_datatype_functions.c	The text_substring_byte loop now checks subStrEnd before advancing past the requested end position.
Add exact-boundary regression coverage contrib/ivorysql_ora/sql/ora_character_datatype_functions.sql, contrib/ivorysql_ora/expected/ora_character_datatype_functions.out	The regression test verifies that SUBSTRB('你好', 1, 6) = '你好' evaluates to t.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 1a435

This change prevents SUBSTRB from inspecting beyond a multibyte input boundary and adds coverage for an exact UTF-8 byte boundary. The implementation and regression expectation align, with no remaining merge-blocking risk.

Suggested reviewers: ai-yang, hs-liuxh

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The implementation guards the multibyte SUBSTRB boundary before advancing and inspecting the next character. The SQL and expected-output changes add regression coverage for a UTF-8 substring that ends…
Out of Scope Changes check	✅ Passed	All changes are directly related to issue #1844. The implementation change and regression test cover the SUBSTRB multibyte boundary defect. No unrelated code changes are present.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (2 skipped: 2 …
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: guarding the Oracle SUBSTRB end boundary for multibyte input.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hanjianqiao]

Thank you for this patch! We'll review it shortly.

[muzimu217]

Built this on aarch64 Linux (master + patch) and ran the full oracle-check
(28/28 with ENCODING=UTF8). Since SUBSTRB boundaries are where the
interesting bugs live, I also cross-checked the byte-level behavior against
Oracle 23ai Free (AL32UTF8) — and the partial-character padding matches
exactly, which is nice to see:

                                Oracle 23ai (DUMP)          this build
SUBSTRB('你好',1,5)    Typ=1 Len=5: 228,189,160,32,32    len=5 hex=e4bda02020
SUBSTRB('你好',1,4)    Typ=1 Len=4: 228,189,160,32       len=4 hex=e4bda020
SUBSTRB('你好',1,6)    Typ=1 Len=6: 228,189,160,229,165,189    len=6, full string

Two observations from the same session, both "sharing data, not asking for
anything":

1. I couldn't construct an input where the added guard changes the outcome.
   Old and new code give identical results for everything I tried — (1,6),
   (1,5), (1,4), (2,2), (1,0), (1,-1), and the ASCII cases — and the
   new regression test passes on unpatched master in my environment as well.
   Since pg_mblen() is always >= 1, the second condition already looks
   unreachable whenever subStrEnd >= sliceBegin + E1 - 1... but I may simply
   be missing the case that motivated the patch; if you have one, I'm curious.

2. There is one spot where Oracle and this build disagree, and it's unrelated
   to the guard:

SUBSTRB('你好',2,2)
Oracle 23ai:  two spaces, LENGTHB = 2   (DUMP: Typ=1 Len=2: 32,32)
this build:   one space,  octet_length = 1

Looks like when the start position lands mid-character, the
subStrEnd == subStrBegin early return hands back a literal " "/" "
and drops prefixSpaceCnt. Mid-character starts are probably rare in real
code, so this is more "data point on record" than anything else.

(Reference for the Oracle side: the SUBSTR family in the 23ai SQL Language
Reference, https://docs.oracle.com/en/database/oracle/oracle-database/23/sqlrf/SUBSTR.html)

[yyqdbngt]

Thanks for the detailed verification. I agree that the ordinary result is unchanged: once the scan pointer reaches the end, any positive pg_mblen() result makes the old condition false. The fix is specifically to avoid evaluating pg_mblen() at the one-past-end address, so reproducing the memory read depends on layout or an instrumented build. I updated the PR description to make that distinction explicit and no longer present the regression as a before/after output failure. The mid-character start padding difference is separate from issue #1844 and should not be folded into this boundary-safety patch.