Function cross_join_with_rels

src/cypher/cypher.c:4202–4243

Cross-join pattern-with-rels into existing bindings */

/* Cross-join pattern-with-rels into existing bindings */
static void cross_join_with_rels(cbm_store_t *store, cbm_pattern_t *patn, binding_t **bindings,
                                 int *bind_count, cbm_node_t *extra_nodes, int extra_count,
                                 const char *nvar, bool opt) {
    /* size_t arithmetic: bind_count * extra_count can exceed INT_MAX on large
     * graphs (e.g. an unbound `c` scanned against ~29 K `f` bindings), wrapping
     * the int product negative and yielding a tiny/garbage malloc → heap OOB
     * write → SIGSEGV/SIGABRT (#627). */
    size_t alloc_n = (size_t)*bind_count * (size_t)extra_count * (size_t)CYP_GROWTH_10 + SKIP_ONE;
    binding_t *new_bindings = malloc(alloc_n * sizeof(binding_t));
    if (!new_bindings) {
        return; /* OOM: leave existing bindings untouched rather than corrupt */
    }
    int new_count = 0;
    for (int bi = 0; bi < *bind_count; bi++) {
        for (int ni = 0; ni < extra_count; ni++) {
            binding_t nb = {0};
            binding_copy(&nb, &(*bindings)[bi]);
            binding_set(&nb, nvar, &extra_nodes[ni]);
            binding_t *tmp = malloc(PAIR_LEN * sizeof(binding_t));
            tmp[0] = nb;
            int tc = SKIP_ONE;
            int tcap = SKIP_ONE;
            const char *tv = nvar;
            expand_pattern_rels(store, patn, &tmp, &tc, &tcap, &tv, opt);
            for (int ti = 0; ti < tc; ti++) {
                new_bindings[new_count++] = tmp[ti];
            }
            free(tmp);
        }
        if (opt && extra_count == 0) {
            binding_t nb = {0};
            binding_copy(&nb, &(*bindings)[bi]);
            new_bindings[new_count++] = nb;
        }
    }
    for (int bi = 0; bi < *bind_count; bi++) {
        binding_free(&(*bindings)[bi]);
    }
    free(*bindings);
    *bindings = new_bindings;
    *bind_count = new_count;
}

/* Drive a single-relationship additional pattern from its ALREADY-BOUND
 * terminal node, binding the unbound START var to the edge's other endpoint.