chore(review): adversarial code review of cpp23 wave (PRs #41-#58)

[lusoris]

Summary

• Read-only adversarial review of the C→C++23 conversion wave (PRs refactor(core): C++23 pilot — mem.c → mem.cpp (ADR-0720) #41, refactor(core): C++23 pilot Wave 1 — opt.c → opt.cpp (ADR-0721) #43, refactor(core): C++23 pilot Wave 2 — fex_ctx_vector.c → .cpp (ADR-0723) #44, refactor(core): C++23 pilot — log.c (real C++23, supersedes #42) #45, refactor(core): cpp23 Wave 2 — project-wide cpp_std=c++23 + dict.c → dict.cpp #48, refactor(core): cpp23 Wave 3 part B — psnr_tools, luminance_tools, mkdirp (ADR-0731) #51, refactor(core): cpp23 Wave 3 — feature_name, picture_copy, model (ADR-0729) #54, refactor(core): cpp23 Wave 4 — output writers (ADR-0733) #56, refactor(core): C++23 Wave 5 — cpu, ref, thread_locale (ADR-0735) #58).
• 4 CRITICAL bugs, 2 HIGH, 10 MEDIUM, 3 LOW findings documented. Zero code changes.
• Recurring conversion smells catalogued in core/AGENTS.md to prevent recurrence.

Critical findings

PR	File	Bug
#43	core/src/opt.cpp	string_view::data() passed to strtol/strtod without guaranteed NUL-termination — UB if a substring string_view is ever passed
#48	core/src/dict.cpp	strtof (returns float) assigned to double dv — precision loss when high-precision option strings are round-tripped through snprintf("%g", dv)
#54	core/src/model.cpp	strlen(model->name) - 5U wraps to SIZE_MAX-4 when name is shorter than 5 chars; downstream calloc(1, SIZE_MAX-4) → heap overflow
#58	core/src/ref.cpp	std::make_unique<VmafRef>() allocates via operator new; C callers that call free(ref_ptr) directly (pre-existing pattern) will corrupt the heap

Test plan

• gh pr diff 41 43 44 45 48 51 54 56 58 -R VMAFx/vmafx reproduces all diffs reviewed.
• No build or test changes in this PR; pre-commit passes on doc-only files.
• Affected PRs should each receive a CRITICAL comment (see step 5 below).

Deep-dive deliverables (ADR-0108)

• Research digest: docs/research/cpp23-wave-adversarial-review-20260528.md
• No ADR needed: this is a review, not a decision
• core/AGENTS.md invariant note: C→C++ conversion safety checklist added
• Reproducer: gh pr diff <N> -R VMAFx/vmafx > /tmp/pr-<N>.diff for N in {41,43,44,45,48,51,54,56,58}
• changelog.d/changed/cpp23-wave-adversarial-review.md
• docs/rebase-notes.md entry added
• docs/state.md row: "cpp23 wave adversarial review (this PR); 4 critical, 2 high, 10 medium"

no rebase impact: read-only review PR; no Netflix upstream surface touched.

🤖 Generated with Claude Code