CI: fix sanitizer link, Windows env, lint, and CodeQL snprintf finding

Four independent CI failure classes on the v2.0 matrix:

- tsan/msan/lsan link error: http_request_unescape_arena_test.cpp defines
  global operator new/delete to count heap allocs; the tsan/msan/lsan
  runtimes ship their own strong definitions, so the test collided at link
  time (multiple definition). Guard the overrides out on those lanes via
  -DLHS_SANITIZER_OWNS_OPERATOR_NEW (set in verify-build.yml) plus
  __has_feature/__SANITIZE_THREAD__ fallbacks. With overrides absent the
  counter stays 0, so the zero-global-alloc pins still hold and the
  correctness/lifetime pins still exercise the real arena path.

- Windows (mingw gcc-16): <stdlib.h> no longer declares POSIX
  setenv/unsetenv. Route the three debug_dump_request_body_* tests through
  _putenv on _WIN32 (VAR= removes the variable under MSVCRT).

- cpplint gate (29 errors, surfaced now that the lint script runs): fixed
  runtime/int, indent_namespace, blank_line, header_guard, IWYU (real
  includes where legal, inline NOLINT in mid-class fragment headers),
  TODO username, and try-clause newline formatting.

- CodeQL high-severity cpp/overflowing-snprintf in peer_address.cpp: the
  IPv6 canonicaliser advanced `pos` by snprintf's return value, which
  CodeQL traced into the next call's `sizeof(buf) - pos` size argument
  (potential size_t underflow, CWE-190). A group is <=4 hex digits so it
  never truncates with buf[40], but add the canonical bound guard so pos
  is provably in-range.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NpysYDDJac63yz2mZKKiDf

Author: etr

.github/workflows/verify-build.yml

@@ -992,11 +992,14 @@ jobs:
         if [ "$BUILD_TYPE" = "msan" ]; then
           LIBCXX_MSAN="${{ github.workspace }}/libcxx-msan" ;
           export CFLAGS="-fsanitize=memory -fsanitize-memory-track-origins -fno-omit-frame-pointer -g -O1" ;
-          export CXXFLAGS="-stdlib=libc++ -nostdinc++ -isystem ${LIBCXX_MSAN}/include/c++/v1 -fsanitize=memory -fsanitize-memory-track-origins -fno-omit-frame-pointer -g -O1" ;
+          export CXXFLAGS="-stdlib=libc++ -nostdinc++ -isystem ${LIBCXX_MSAN}/include/c++/v1 -fsanitize=memory -fsanitize-memory-track-origins -fno-omit-frame-pointer -g -O1 -DLHS_SANITIZER_OWNS_OPERATOR_NEW" ;
           export LDFLAGS="-stdlib=libc++ -fsanitize=memory -L${LIBCXX_MSAN}/lib -Wl,-rpath,${LIBCXX_MSAN}/lib -lc++abi" ;
         fi
-        if [ "$BUILD_TYPE" = "lsan" ]; then export CFLAGS='-fsanitize=leak'; export CXXFLAGS='-fsanitize=leak'; export LDFLAGS='-fsanitize=leak'; fi
-        if [ "$BUILD_TYPE" = "tsan" ]; then export CFLAGS='-fsanitize=thread'; export CXXFLAGS='-fsanitize=thread'; export LDFLAGS='-fsanitize=thread'; fi
+        # tsan/msan/lsan runtimes define their own global operator new/delete;
+        # -DLHS_SANITIZER_OWNS_OPERATOR_NEW makes the arena alloc-pin test drop
+        # its overrides so it links (see test/unit/http_request_unescape_arena_test.cpp).
+        if [ "$BUILD_TYPE" = "lsan" ]; then export CFLAGS='-fsanitize=leak'; export CXXFLAGS='-fsanitize=leak -DLHS_SANITIZER_OWNS_OPERATOR_NEW'; export LDFLAGS='-fsanitize=leak'; fi
+        if [ "$BUILD_TYPE" = "tsan" ]; then export CFLAGS='-fsanitize=thread'; export CXXFLAGS='-fsanitize=thread -DLHS_SANITIZER_OWNS_OPERATOR_NEW'; export LDFLAGS='-fsanitize=thread'; fi
         if [ "$BUILD_TYPE" = "ubsan" ]; then export CFLAGS='-fsanitize=undefined'; export CXXFLAGS='-fsanitize=undefined'; export LDFLAGS='-fsanitize=undefined'; fi
 
         # Additional flags on mac. They need to stay in step as env variables don't propagate across steps.

src/detail/ip_representation.cpp

@@ -141,7 +141,7 @@ void ip_representation::parse_ipv4(const std::string& ip) {
             clear_bit(mask, static_cast<unsigned int>(12 + i));
             continue;
         }
-        const long piece = strtol(parts[i].c_str(), nullptr, 10);
+        const int64_t piece = strtol(parts[i].c_str(), nullptr, 10);
         if (piece < 0 || piece > 255) {
             throw std::invalid_argument("IP is badly formatted. 255 is max value for ip part.");
         }
@@ -206,7 +206,7 @@ void ip_representation::parse_nested_ipv4(const std::vector<std::string>& parts,
             clear_bit(mask, static_cast<unsigned int>(y + ii));
             continue;
         }
-        const long subpart = strtol(subparts[ii].c_str(), nullptr, 10);
+        const int64_t subpart = strtol(subparts[ii].c_str(), nullptr, 10);
         if (subpart < 0 || subpart > 255) {
             throw std::invalid_argument("IP is badly formatted. 255 is max value for ip part.");
         }
@@ -243,12 +243,12 @@ void ip_representation::apply_ipv6_part(std::vector<std::string>& parts, unsigne
         const std::string hi_str = part.substr(0, 2);
         const std::string lo_str = part.substr(2, 2);
         char* endp = nullptr;
-        const long hi = strtol(hi_str.c_str(), &endp, 16);
+        const int64_t hi = strtol(hi_str.c_str(), &endp, 16);
         if (*endp != '\0') {
             throw std::invalid_argument(
                 "IP is badly formatted. IPV6 part contains a non-hex character.");
         }
-        const long lo = strtol(lo_str.c_str(), &endp, 16);
+        const int64_t lo = strtol(lo_str.c_str(), &endp, 16);
         if (*endp != '\0') {
             throw std::invalid_argument(
                 "IP is badly formatted. IPV6 part contains a non-hex character.");

src/httpserver/detail/lambda_resource.hpp

@@ -75,8 +75,7 @@ namespace detail {
 // variant arm was dead code (no writer stored a lambda directly — every
 // on_*/route path funnels through lambda_resource), so it was removed.
 // The typedef relocates here, where its remaining uses are.
-using lambda_handler =
-    std::function<::httpserver::http_response(const ::httpserver::http_request&)>;
+using lambda_handler = std::function<::httpserver::http_response(const ::httpserver::http_request&)>;
 
 // Tiny adapter that wraps a single lambda_handler as an http_resource
 // virtual override. We keep one slot per method enum and dispatch in

src/httpserver/detail/webserver_impl_dispatch.hpp

@@ -362,7 +362,7 @@ const detail::route_entry* find_v2_entry_by_path_(
 // Returns {shim, is_fresh}: is_fresh is true when a brand-new
 // lambda_resource shim was created (no entry previously existed at
 // this path), false when an existing shim was reused.
-std::pair<std::shared_ptr<detail::lambda_resource>, bool>
+std::pair<std::shared_ptr<detail::lambda_resource>, bool>  // NOLINT(build/include_what_you_use)
     prepare_or_create_lambda_shim(const detail::http_endpoint& idx,
                                   method_set methods);
 void commit_handlers_to_shim(detail::lambda_resource& shim,

src/httpserver/http_request.hpp

@@ -284,6 +284,7 @@ class http_request {
      // NOT part of the public ABI; only visible when the library itself
      // is being compiled (gated by HTTPSERVER_COMPILATION).
      MHD_Connection* underlying_connection_for_testing() const noexcept;
+
  private:
 #endif  // HTTPSERVER_COMPILATION
 

src/httpserver/webserver_routes.hpp

@@ -112,7 +112,7 @@ template <typename T,
               std::is_base_of_v<http_resource, T>>>
 void register_prefix(const std::string& path, std::unique_ptr<T> res) {
     register_prefix(path,
-                    std::shared_ptr<http_resource>(std::move(res)));
+                    std::shared_ptr<http_resource>(std::move(res)));  // NOLINT(build/include_what_you_use)
 }
 /**
  * Register a resource for a prefix URL match (shared_ptr overload).
@@ -125,7 +125,7 @@ void register_prefix(const std::string& path, std::unique_ptr<T> res) {
  *             a reference.
 **/
 void register_prefix(const std::string& path,
-                     std::shared_ptr<http_resource> res);
+                     std::shared_ptr<http_resource> res);  // NOLINT(build/include_what_you_use)
 
 /**
  * Register a lambda handler for HTTP GET on @p path.

src/peer_address.cpp

@@ -126,6 +126,14 @@ std::string emit_canonical(const ipv6_groups& g, const zero_run& collapse) {
         }
         int n = std::snprintf(buf + pos, sizeof(buf) - pos, "%x",
                                static_cast<unsigned>(g[i]));
+        // snprintf returns the length it WOULD have written (excl. NUL).
+        // A group is at most 4 hex digits, so with buf[40] this branch is
+        // never taken; the explicit guard keeps `pos` provably within the
+        // buffer so the `sizeof(buf) - pos` size argument can never
+        // underflow into a huge size_t (cpp/overflowing-snprintf, CWE-190).
+        if (n < 0 || static_cast<std::size_t>(n) >= sizeof(buf) - pos) {
+            return std::string(buf, pos);
+        }
         pos += static_cast<std::size_t>(n);
         ++i;
         // Emit a ':' separator if more groups remain AND the next slot

test/bench_sizeof_http_resource.cpp

@@ -88,7 +88,7 @@ using httpserver::v1_baseline::V1_STD_MAP_STRING_BOOL_SIZEOF;
 // TASK-058's Allow cache needed, this assertion breaks at compile
 // time and the growth gets reviewed.
 //
-// TODO: unlike V1_GET_HEADERS_NS_PER_CALL in bench_get_headers.cpp (which
+// TODO(etr): unlike V1_GET_HEADERS_NS_PER_CALL in bench_get_headers.cpp (which
 // carries a per-stdlib defensive static_assert against an accidental
 // cross-stdlib swap, e.g. a libstdc++ value silently reused on libc++),
 // V1_HTTP_RESOURCE_SIZEOF / V1_STD_MAP_STRING_BOOL_SIZEOF below have no

test/integ/authentication.cpp

@@ -34,6 +34,7 @@
 #include <memory>
 #include <optional>
 #include <string>
+#include <utility>
 
 #include "./httpserver.hpp"
 #include "./littletest.hpp"
@@ -320,6 +321,7 @@ class digest_ha1_resource : public http_resource {
          }
          return http_response::string("SUCCESS");
      }
+
  private:
     http_utils::digest_algorithm algo_;
     const unsigned char* ha1_;

test/integ/debug_dump_request_body_set_test.cpp

@@ -196,6 +196,11 @@ LT_END_AUTO_TEST(dump_body_to_stdout_when_env_set)
 LT_BEGIN_AUTO_TEST_ENV()
     // Opt in BEFORE the test bodies run (and BEFORE the magic-static
     // cache in the body pipeline is initialised on first dispatch).
+#ifdef _WIN32
+    // MinGW's <stdlib.h> does not always declare POSIX setenv.
+    _putenv("LIBHTTPSERVER_DEBUG_DUMP_REQUEST_BODY=1");
+#else
     ::setenv("LIBHTTPSERVER_DEBUG_DUMP_REQUEST_BODY", "1", 1);
+#endif
     AUTORUN_TESTS()
 LT_END_AUTO_TEST_ENV()