Function expand_pattern_rels

src/cypher/cypher.c:3288–3359

}

static void expand_pattern_rels(cbm_store_t *store, cbm_pattern_t *pat, binding_t **bindings,
                                int *bind_count, const int *bind_cap, const char **var_name,
                                bool is_optional) {
    for (int ri = 0; ri < pat->rel_count; ri++) {
        /* #601: stop expanding further hops once the wall-clock budget is spent
         * (an unbounded expansion is exactly what blows up here). */
        if (cypher_deadline_exceeded()) {
            return;
        }
        cbm_rel_pattern_t *rel = &pat->rels[ri];
        cbm_node_pattern_t *target_node = &pat->nodes[ri + SKIP_ONE];
        const char *to_var = target_node->variable ? target_node->variable : "_n_t";

        bool is_variable_length = (rel->min_hops != SKIP_ONE || rel->max_hops != SKIP_ONE);

        /* Size this hop's output for BOTH writers without dropping any row: the
         * expansion helpers emit at most max_new = bind_cap*10 rows (they stop at
         * max_new), and the OPTIONAL fallback emits at most one row per source
         * (<= *bind_count). A source either matches (feeds the expansion) or takes
         * the fallback, never both, so the two counts are additive and bounded by
         * max_new + *bind_count. Computed in size_t so the product cannot overflow.
         * The previous "+ 1" sizing fit only a SINGLE fallback row after a
         * saturated expansion; a second one ran off the end (heap OOB, CWE-787). */
        size_t alloc_n = (size_t)*bind_cap * (size_t)CYP_GROWTH_10 + (size_t)*bind_count;
        binding_t *new_bindings = malloc(alloc_n * sizeof(binding_t));
        if (!new_bindings) {
            return; /* OOM: leave existing bindings untouched rather than corrupt */
        }
        int new_count = 0;

        for (int bi = 0; bi < *bind_count; bi++) {
            if ((bi & CYPHER_DEADLINE_CHECK_MASK) == 0 && cypher_deadline_exceeded()) {
                break;
            }
            binding_t *b = &(*bindings)[bi];
            cbm_node_t *src = binding_get(b, *var_name);
            if (!src) {
                continue;
            }

            int match_count = 0;

            int max_new = *bind_cap * CYP_GROWTH_10;
            if (is_variable_length) {
                expand_var_length(store, rel, target_node, b, src, to_var, new_bindings, &new_count,
                                  max_new, &match_count);
            } else {
                expand_fixed_length(store, rel, target_node, b, src, to_var, new_bindings,
                                    &new_count, max_new, &match_count);
            }

            /* OPTIONAL MATCH: no expansion for this source, so keep the binding
             * with the target unbound (projection renders it ""). The buffer is
             * sized max_new + *bind_count precisely so every such fallback row has
             * a slot — no guard needed, and no OPTIONAL no-match row is dropped. */
            if (is_optional && match_count == 0) {
                binding_t nb = {0};
                binding_copy(&nb, b);