[aneubeck]

Summary

Fixes the remaining 3 Medium-severity and 3 Low-severity ai-scan/* code-scanning alerts across bpe-openai, consistent-choose-k, geo_filters, and string-offsets (tracked in github/blackbird#17346, following up on #175):

Medium-severity alerts

• bpe-openai
  • Code scanning alert #7 (ai-scan/cwe-835, crates/bpe-openai/src/lib.rs:204): Move the non-empty match assertion assert_ne!(end, start, ...) outside the self.lookahead branch in Splits::next so any caller-supplied regex that matches an empty string panics immediately instead of looping infinitely.
• geo_filters
  • Code scanning alert #18 (ai-scan/cwe-835, crates/geo_filters/src/config/bitchunks.rs:182): Assert (1..BITS_PER_BLOCK).contains(&modulus) in MaskedBitChunksIterator::new (matching GeoDiffCount::masked_sort_key) so cmp_masked with mask_size == 0 panics instead of looping infinitely on i *= 2.
• consistent-choose-k
  • Code scanning alert #19 (ai-scan/cwe-400, crates/consistent-choose-k/src/consistent_reservoir.rs:286): Enforce the documented assert!(k <= n, "k must be at most n") invariant in ConsistentReservoir::new to prevent exhausting the full permutation layer (up to $2^{30}$ iterations) when k > n.

Low-severity alerts

• string-offsets
  • Code scanning alert #10 (ai-scan/cwe-190, crates/string-offsets/src/lib.rs:291): Use saturating_add(1) / saturating_sub(1) in StringOffsets::utf8_to_char and line_to_utf8_end so usize::MAX offsets saturate to the end of the string as documented instead of overflowing.
  • Code scanning alert #17 (ai-scan/cwe-197, crates/string-offsets/src/lib.rs:395): Assert u32::try_from(content.len()).is_ok() in new_converter before casting line start offsets to u32.
• geo_filters
  • Code scanning alert #16 (ai-scan/cwe-758, crates/geo_filters/src/config.rs:339): Gate the _pdep_u64 implementation of nth_one on #[cfg(all(target_arch = "x86_64", target_feature = "bmi2"))], falling back to the portable bit-clearing loop when compiled without bmi2.

Test plan

• cargo fmt --all -- --check
• cargo clippy -- --no-deps --deny warnings -D clippy::unwrap_used
• cargo clippy --tests -- --no-deps --deny warnings -A clippy::unwrap_used
• cargo test -p consistent-choose-k -p geo_filters -p bpe-openai -p string-offsets

[Copilot]

🟢 Approval recommended

No active review issues remain for the changes addressing input validation, offset safety, and BMI2 portability.

No open issues 🎉

What changed in this PR

This PR follows up on #175 by addressing six remaining medium- and low-severity code-scanning alerts across four crates.

Changes:

• Reject empty regex matches, invalid mask sizes, and reservoir sizes that exceed the population.
• Use saturating offset arithmetic and validate content length before narrowing offsets to u32.
• Gate the BMI2 intrinsic on compile-time feature support and add regression tests for invalid inputs and maximum offsets.

File	Description
crates/​string-offsets/​src/​lib.rs	Prevents offset overflow, validates content length, and tests maximum offsets.
crates/​geo_filters/​src/​diff_count.rs	Tests rejection of a zero mask size.
crates/​geo_filters/​src/​config/​bitchunks.rs	Validates mask size before constructing the iterator.
crates/​geo_filters/​src/​config.rs	Uses the portable fallback when BMI2 is not enabled.
crates/​consistent-choose-k/​src/​consistent_reservoir.rs	Enforces k <= n and tests rejection of invalid sizes.
crates/​bpe-openai/​src/​lib.rs	Rejects empty matches regardless of lookahead mode and adds a regression test.

_{Review effort: Balanced (auto)}