fix(dsa): guard allocation and cache eviction boundaries

COMPLEXITY.md

@@ -493,6 +493,10 @@ False Positive Rate ≈ (1 - e^(-kn/m))^k
 Implementation: Hash Map + Doubly Linked List
 ```
 
+The Rust `LRUCache` uses a `BTreeMap` and linked nodes. Its get, peek, and
+remove operations are O(log n); put is O(n) in the worst case because eviction
+scans the map to remove the exact node before freeing it.
+
 **When to Use:**
 
 - Caching with memory limit

REMEDIATION.md

@@ -11,6 +11,9 @@ possible input or deployment has been audited.
 | Area | Current contract |
 |------|------------------|
 | C shortest paths | `shortest_path_reconstruct` takes `path_capacity` in elements and returns `false` for an insufficient buffer, invalid destination, unreachable path, or negative-cycle result. |
+| C segment tree | Both constructors return `NULL` when `4 * n` integer slots cannot fit in `size_t`; callers must check the result before querying or updating. |
+| C B-tree | `btree_create` returns `NULL` when the minimum degree is below 2 or too large for signed arithmetic or node allocations. |
+| Rust LRU cache | Eviction removes the map entry by node identity before freeing the node, including for keys whose clones compare differently. The map is a `BTreeMap`; eviction scans it, so `put` is O(n) in the worst case. |
 | Rust shortest paths | `reconstruct_path(parent, source, target)` requires the actual source and returns `None` for invalid or cyclic parent chains. |
 | Fenwick updates | Rust uses one-based indices; Go, Python, and TypeScript use zero-based indices. Invalid update indices are rejected before entering the update loop. |
 | Python segment tree | Point updates outside `[0, len)` raise `IndexError`. |
@@ -28,15 +31,17 @@ possible input or deployment has been audited.
 
 ## Regression areas
 
-- C allocation arithmetic, trie enumeration, search byte counters, graph path
-  buffers, counting/radix sort, hash tombstones, and B-tree root changes.
+- C allocation arithmetic, including segment-tree sizes and B-tree degree,
+  trie enumeration, search byte counters, graph path buffers, counting/radix
+  sort, hash tombstones, and B-tree root changes.
 - Graph algorithms: absent destinations, negative vertex labels, self-loops,
   parallel edges, object-valued vertices, and path reconstruction from a
   nonzero source.
 - String algorithms: delimiters occurring in input, Unicode boundaries, and
   palindrome sentinels.
 - Data structures: lazy segment-tree logical length, skip-list live length,
-  Fenwick index validation, LFU frequency buckets, and panic-safe LRU clear.
+  Fenwick index validation, LFU frequency buckets, panic-safe LRU clear, and
+  node-identity eviction for non-equivalent Rust key clones.
 - Sorting: negative values, all-negative input, and integer-type extremes for
   every sort, including the counting-sort comparison fallback.
 - Randomized model tests in every language compare sorts, searches, string

by-language/c/data-structures/b_tree.c

@@ -6,6 +6,8 @@
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
+#include <limits.h>
+#include <stdint.h>
 
 /* ============== Node Creation/Destruction ============== */
 
@@ -530,7 +532,11 @@ static void print_node(BTreeNode *node, int depth) {
 /* ============== Public Functions ============== */
 
 BTree *btree_create(int min_degree) {
-    if (min_degree < 2) return NULL;
+    if (min_degree < 2 || min_degree > INT_MAX / 2) return NULL;
+
+    size_t max_children = (size_t)min_degree * 2;
+    if (max_children > SIZE_MAX / sizeof(BTreeNode *) ||
+        max_children - 1 > SIZE_MAX / sizeof(int)) return NULL;
 
     BTree *tree = malloc(sizeof(BTree));
     if (!tree) return NULL;

by-language/c/data-structures/b_tree.h

@@ -71,7 +71,7 @@ typedef struct {
 
 /**
  * Create a new B-Tree with specified minimum degree.
- * @param min_degree Minimum degree t (must be >= 2)
+ * @param min_degree Minimum degree t (must be >= 2 and fit node allocations)
  * @return New tree or NULL on failure
  */
 BTree *btree_create(int min_degree);

by-language/c/data-structures/segment_tree.c

@@ -7,6 +7,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <limits.h>
+#include <stdint.h>
 
 /* ============== Helper Functions ============== */
 
@@ -62,8 +63,12 @@ static void build(SegmentTree *st, const int *arr, size_t node,
 
 /* ============== Creation/Destruction ============== */
 
+static bool valid_tree_size(size_t n) {
+    return n > 0 && n <= SIZE_MAX / sizeof(int) / 4;
+}
+
 SegmentTree *segtree_create(const int *arr, size_t n, SegmentTreeType type) {
-    if (arr == NULL || n == 0) return NULL;
+    if (arr == NULL || !valid_tree_size(n)) return NULL;
 
     SegmentTree *st = malloc(sizeof(SegmentTree));
     if (st == NULL) return NULL;
@@ -73,8 +78,9 @@ SegmentTree *segtree_create(const int *arr, size_t n, SegmentTreeType type) {
     st->identity = get_identity(type);
 
     /* Allocate tree array (4*n is safe upper bound) */
-    st->tree = malloc(4 * n * sizeof(int));
-    st->lazy = calloc(4 * n, sizeof(int));
+    size_t capacity = 4 * n;
+    st->tree = malloc(capacity * sizeof(int));
+    st->lazy = calloc(capacity, sizeof(int));
 
     if (st->tree == NULL || st->lazy == NULL) {
         free(st->tree);
@@ -84,7 +90,7 @@ SegmentTree *segtree_create(const int *arr, size_t n, SegmentTreeType type) {
     }
 
     /* Initialize with identity */
-    for (size_t i = 0; i < 4 * n; i++) {
+    for (size_t i = 0; i < capacity; i++) {
         st->tree[i] = st->identity;
     }
 
@@ -93,7 +99,7 @@ SegmentTree *segtree_create(const int *arr, size_t n, SegmentTreeType type) {
 }
 
 SegmentTree *segtree_create_empty(size_t n, SegmentTreeType type) {
-    if (n == 0) return NULL;
+    if (!valid_tree_size(n)) return NULL;
 
     SegmentTree *st = malloc(sizeof(SegmentTree));
     if (st == NULL) return NULL;
@@ -102,8 +108,9 @@ SegmentTree *segtree_create_empty(size_t n, SegmentTreeType type) {
     st->type = type;
     st->identity = get_identity(type);
 
-    st->tree = malloc(4 * n * sizeof(int));
-    st->lazy = calloc(4 * n, sizeof(int));
+    size_t capacity = 4 * n;
+    st->tree = malloc(capacity * sizeof(int));
+    st->lazy = calloc(capacity, sizeof(int));
 
     if (st->tree == NULL || st->lazy == NULL) {
         free(st->tree);
@@ -112,7 +119,7 @@ SegmentTree *segtree_create_empty(size_t n, SegmentTreeType type) {
         return NULL;
     }
 
-    for (size_t i = 0; i < 4 * n; i++) {
+    for (size_t i = 0; i < capacity; i++) {
         st->tree[i] = st->identity;
     }
 

by-language/c/data-structures/segment_tree.h

@@ -72,15 +72,15 @@ typedef struct {
  * @param arr Input array
  * @param n Array size
  * @param type Type of query (SUM, MIN, MAX, GCD)
- * @return New segment tree or NULL on failure
+ * @return New segment tree or NULL if the size is invalid or allocation fails
  */
 SegmentTree *segtree_create(const int *arr, size_t n, SegmentTreeType type);
 
 /**
  * Create an empty segment tree.
  * @param n Size
  * @param type Type of query
- * @return New segment tree or NULL on failure
+ * @return New segment tree or NULL if the size is invalid or allocation fails
  */
 SegmentTree *segtree_create_empty(size_t n, SegmentTreeType type);
 

by-language/c/tests/test_btree.c

@@ -5,6 +5,7 @@
 #include "test_framework.h"
 #include "../data-structures/b_tree.h"
 #include <stdlib.h>
+#include <limits.h>
 
 /* ============== Creation Tests ============== */
 
@@ -31,6 +32,8 @@ TEST(btree_create_with_degree) {
 TEST(btree_create_invalid) {
     ASSERT_TRUE(btree_create(0) == NULL);
     ASSERT_TRUE(btree_create(1) == NULL);
+    ASSERT_TRUE(btree_create(INT_MAX / 2 + 1) == NULL);
+    ASSERT_TRUE(btree_create(INT_MAX) == NULL);
 }
 
 /* ============== Insert Tests ============== */

by-language/c/tests/test_range_trees.c

@@ -6,12 +6,21 @@
 #include "../data-structures/segment_tree.h"
 #include "../data-structures/fenwick_tree.h"
 #include <stdint.h>
+#include <stdlib.h>
 
 TEST(fenwick_rejects_overflow_size) {
     ASSERT_TRUE(fenwick_create_empty(SIZE_MAX) == NULL);
 }
-#include <stdlib.h>
 
+TEST(segtree_rejects_overflow_size) {
+    size_t array_length_overflow = SIZE_MAX / 4 + 2;
+    size_t allocation_bytes_overflow = SIZE_MAX / sizeof(int) / 4 + 1;
+    int value = 1;
+    ASSERT_TRUE(segtree_create_empty(array_length_overflow, SEG_SUM) == NULL);
+    ASSERT_TRUE(segtree_create(&value, array_length_overflow, SEG_SUM) == NULL);
+    ASSERT_TRUE(segtree_create_empty(allocation_bytes_overflow, SEG_SUM) == NULL);
+    ASSERT_TRUE(segtree_create(&value, allocation_bytes_overflow, SEG_SUM) == NULL);
+}
 /* ============== Segment Tree Creation Tests ============== */
 
 TEST(segtree_create_sum) {
@@ -281,6 +290,7 @@ int main(void) {
     RUN_TEST(fenwick_rejects_overflow_size);
 
     /* Segment Tree Creation */
+    RUN_TEST(segtree_rejects_overflow_size);
     RUN_TEST(segtree_create_sum);
     RUN_TEST(segtree_create_min);
     RUN_TEST(segtree_create_max);

by-language/rust/.gitignore

@@ -1,6 +1,5 @@
 # Generated by Cargo
 /target/
-Cargo.lock
 
 # IDE
 .idea/