A bitfield width must not exceed the bit width of its underlying type

C requires 1 <= width <= sizeof(type)*CHAR_BIT). This must also be consistent with what the printer can emit, or the type->string->type round trip fuzzer would break.

Author: sanko

CHANGELOG.md

@@ -15,6 +15,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Bitfield member layout now records the storage-unit base in `member->offset` with `bit_offset` relative to that unit, instead of pointing `member->offset` at the bitfield's own (possibly mid-unit) byte with a `% 8` bit remainder. Callers that read or write a whole storage unit, like Affix's marshaller and pinned bitfield magic, always stay within the aggregate's bounds now; previously a bitfield whose low bit was not byte-aligned could drive a unit-sized access one byte past the end of the struct (heap-buffer-overflow caught by ASan).
 - JIT executable memory is now flushed with `FlushInstructionCache` whenever built on Windows, including clang builds.
+- Bitfield widths are validated against the underlying type's bit size (1 to `sizeof(type) * 8`), so widths that C allows for 128-bit types (e.g. `sint128:93`) no longer get rejected after a type→string→type round trip, while still-invalid widths (larger than the type) are refused. A flat cap of 64 had made the `fuzz_roundtrip` harness abort on `{fuzz_bf:sint128:93,...}` because the printer emitted a width the parser would not accept again.
 
 ## [0.2.1] - 2026-08-04
 

src/core/signature.c

@@ -294,7 +294,12 @@ static infix_struct_member * parse_aggregate_members(parser_state * state, char
                     size_t width_val = 0;
                     if (!parse_size_t(state, &width_val))
                         return nullptr;  // Error set by parse_size_t
-                    if (width_val > 64) {
+                    size_t type_bits = member_type->size * 8;
+                    // Unresolved named reference (size 0) or a huge base type: cap at the
+                    // uint8_t storage limit so the width is never truncated.
+                    if (type_bits == 0 || type_bits > 255)
+                        type_bits = 255;
+                    if (width_val > type_bits) {
                         _infix_set_parser_error(state, INFIX_CODE_TYPE_TOO_LARGE);
                         return nullptr;
                     }

t/011_bitfields.c

@@ -39,7 +39,7 @@ void bitfield_handler(infix_reverse_t * ctx, void * ret, void ** args) {
 }
 
 TEST {
-    plan(2);
+    plan(3);
     subtest("Basic Bitfields") {
         plan(8);
         infix_arena_t * arena = NULL;
@@ -111,4 +111,42 @@ TEST {
 
         infix_arena_destroy(arena);
     }
+    subtest("Wide Bitfield Round Trip") {
+        // Regression (fuzz_roundtrip crash 9421a219): bitfield widths up to the
+        // underlying type's bit size must survive parse -> print -> re-parse.
+        // A flat cap of 64 rejected valid 128-bit-type widths (e.g. `sint128:93`).
+        plan(13);
+        const char * sigs[] = {
+            "{fuzz_bf:sint128:93,fuzz:*void}",
+            "{a:sint128:128}",
+            "{a:sint64:64}",
+            "{a:sint8:8}",
+        };
+        for (size_t i = 0; i < sizeof(sigs) / sizeof(sigs[0]); ++i) {
+            infix_type * t = NULL;
+            infix_arena_t * a = NULL;
+            infix_status s = infix_type_from_signature(&t, &a, sigs[i], NULL);
+            ok(s == INFIX_SUCCESS, "Parsed %s", sigs[i]);
+            if (s == INFIX_SUCCESS) {
+                char buf[512];
+                infix_status p = infix_type_print(buf, sizeof(buf), t, INFIX_DIALECT_SIGNATURE);
+                ok(p == INFIX_SUCCESS, "Printed %s", sigs[i]);
+                infix_type * t2 = NULL;
+                infix_arena_t * a2 = NULL;
+                infix_status r = infix_type_from_signature(&t2, &a2, buf, NULL);
+                ok(r == INFIX_SUCCESS, "Re-parsed printed output %s", sigs[i]);
+                if (a2)
+                    infix_arena_destroy(a2);
+            }
+            if (a)
+                infix_arena_destroy(a);
+        }
+        // Over-wide bitfields must still be rejected.
+        infix_type * bad = NULL;
+        infix_arena_t * bad_arena = NULL;
+        infix_status bs = infix_type_from_signature(&bad, &bad_arena, "{a:sint64:65}", NULL);
+        ok(bs != INFIX_SUCCESS, "Rejected width beyond underlying type ({a:sint64:65})");
+        if (bad_arena)
+            infix_arena_destroy(bad_arena);
+    }
 }