chore(buglog): harness batch fixed (da1a663f): bug-1574/1702/1703/1705/1707-1710/1712/1777/1793/1796/1797

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.wolf/bugs/bug-1702.md

@@ -1,16 +1,17 @@
 ---
 id: "bug-1702"
-status: "open"
-status_updated: "2026-09-24"
-status_note: "xce_test jobrun -m host strncpy into 256B stack buffer unbounded (src/harness/test.c)"
+status: "fixed"
+status_updated: "2026-09-28"
+status_note: ""
 component: "controller"
 severity: "unknown"
 timestamp: "2026-08-26T09:32:18Z"
 last_seen: "2026-09-19T09:00:00Z"
 occurrences: 1
-files: ["src/controller/testsuite/test.c:2130-2136 (cmd_jobrun)"]
+files: ["src/harness/test.c"]
 tags: ["controller", "testsuite", "xce_test", "cmd_jobrun", "buffer-overflow", "memory-safety", "cli-ux-audit"]
 related: ["bug-1703"]
+fix_commits: ["da1a663f"]
 legacy: true
 ---
 
@@ -29,10 +30,12 @@ _Not recorded (migrated from buglog.json)._
 `strncpy(buf, optarg, (int)(p - optarg))` uses the attacker/user-controlled substring length directly with no `MIN(..., sizeof(buf)-1)` clamp, unlike sibling code elsewhere in the file that does bound similar copies.
 
 ## Fix
-NOT YET FIXED. Recommended: clamp the copy length to sizeof(buf)-1 (or reject a host-name segment longer than the buffer with a usage error) before strncpy.
+jobrun's -m now goes through cmdutil_split_host_tasks() (src/harness/cmdutil.c), which refuses a host segment that does not fit the 256-byte buffer (-ENAMETOOLONG → "host name in -m ... is longer than 255 characters") and an ntasks that is not an integer >= 1.
 
 ## Verification
-_Not recorded (migrated from buglog.json)._
+- Test: test_jobrun_overlong_host_rejected_without_overflow in src/harness/testsuite/test_test_cli.c: RED before the fix (ASAN stack-buffer-overflow, WRITE of size 300, xce_test died), GREEN after; plus the split_host_tasks cases in src/harness/testsuite/test_cmdutil.c (a canary after the host buffer stays intact)
+- Suites: harness 6/6 (asan): harness_unit_test 141/0, cmdutil 14/0, resval_typeresolve 7/0, joblist_display 22/0, join_worker_args 7/0, listrow_json 12/0
+- Live: n/a; xce_test is a client tool and every case above runs without a controller
 
 ## References
 - Related: bug-1703