==> /opt/civet0/build_0/_env/conda-bld/moose-pprof_1780901019757/_build_env/bin/git log -n1 <==
commit 92041b743c966065641d7221da5403ad9a019bce
Author: evilgensec <evil.gen.sec@gmail.com>
Date:   Thu May 7 07:22:55 2026 +0545

    internal/driver: guard BuildID slice in locateBinaries against short values (#998)
    
    The LLVM debug-file lookup sliced m.BuildID[:2] and m.BuildID[2:] to
    construct a filesystem path of the form <path>/<first2>/<rest>.debug.
    The existing guard only checked m.BuildID != "", so a BuildID with
    fewer than two characters (e.g. a single byte) caused a panic:
      runtime error: slice bounds out of range [:2] with length 1
    
    The profile.proto format imposes no minimum length on BuildID, and the
    profile.CheckValid() function does not validate it either. A crafted
    profile with a one-character BuildID therefore reliably crashes any
    process that calls locateBinaries, including tools or servers that
    accept and analyze user-supplied profiles.
    
    Fix: wrap the LLVM path construction in a len(m.BuildID) >= 2 guard,
    matching the documented precondition of the LLVM build-id protocol
    ('the first two characters are used as directory').
    
    Add a test case with BuildID="X" to TestSymbolizationPath to prevent
    regression.
==> /opt/civet0/build_0/_env/conda-bld/moose-pprof_1780901019757/_build_env/bin/git describe --tags --dirty <==
commit 92041b743c966065641d7221da5403ad9a019bce
Author: evilgensec <evil.gen.sec@gmail.com>
Date:   Thu May 7 07:22:55 2026 +0545

    internal/driver: guard BuildID slice in locateBinaries against short values (#998)
    
    The LLVM debug-file lookup sliced m.BuildID[:2] and m.BuildID[2:] to
    construct a filesystem path of the form <path>/<first2>/<rest>.debug.
    The existing guard only checked m.BuildID != "", so a BuildID with
    fewer than two characters (e.g. a single byte) caused a panic:
      runtime error: slice bounds out of range [:2] with length 1
    
    The profile.proto format imposes no minimum length on BuildID, and the
    profile.CheckValid() function does not validate it either. A crafted
    profile with a one-character BuildID therefore reliably crashes any
    process that calls locateBinaries, including tools or servers that
    accept and analyze user-supplied profiles.
    
    Fix: wrap the LLVM path construction in a len(m.BuildID) >= 2 guard,
    matching the documented precondition of the LLVM build-id protocol
    ('the first two characters are used as directory').
    
    Add a test case with BuildID="X" to TestSymbolizationPath to prevent
    regression.
==> /opt/civet0/build_0/_env/conda-bld/moose-pprof_1780901019757/_build_env/bin/git status <==
HEAD detached at 92041b7
Untracked files:
  (use "git add <file>..." to include in what will be committed)
	build_env_setup.sh
	conda_build.sh
	metadata_conda_debug.yaml

nothing added to commit but untracked files present (use "git add" to track)
