[jsuto]

Problem

parse_line() calls is_substr_in_hash() on every line. That walks all 277 hash buckets and runs strstr() against every boundary seen so far. extract_boundary() has no limit on how many boundaries it stores, so a deeply nested message with a distinct boundary per level parses in O(N²). Any message accepted on the SMTP path reaches this code.

Fix

• is_boundary_line(): a line counts as a boundary only if it is -- + boundary, optionally followed by -- (closing delimiter) and trailing whitespace. It checks with a hash lookup instead of a substring scan.
• MAX_BOUNDARIES (128): a cap on boundaries per message, so hash chains stay short. Without it, lookups still grew superlinearly.
• Trimming: extract_boundary() now strips trailing whitespace from boundaries.
• Test: new unit test test_is_boundary_line().

Benchmark

Nested message with a distinct boundary per level, parse_message() only:

Size	master	this PR
1 MiB	1.46 s	0.027 s
2 MiB	5.73 s	0.055 s
4 MiB	23.7 s	0.109 s
16 MiB	—	0.42 s

Behaviour changes

• Mid-line boundaries: a boundary string in the middle of a line, or with leading whitespace, is no longer treated as a delimiter (as RFC 2046 requires).
• Nesting limit: boundaries after the 128th in a message are ignored.
• Long boundaries: delimiter lines longer than about 509 chars are not recognised. RFC 2046 limits boundaries to 70 chars.

Testing

Unit tests pass in sutoj/builder:resolute, including the DB-backed check_parser against the .eml fixtures.

🤖 Generated with Claude Code