From ad9148d867aaecb0cf2a556c79ccee7e3c8f8d9e Mon Sep 17 00:00:00 2001
From: harald <harald@pansi.eu>
Date: Sat, 19 Sep 2026 09:12:30 +0200
Subject: [PATCH] =?UTF-8?q?fix(build):=20M-02=20=E2=80=94=20enable=20overf?=
 =?UTF-8?q?low=20checks=20in=20release=20profile?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Cargo.toml                |  1 +
 tests/integration_test.rs | 17 +++++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/Cargo.toml b/Cargo.toml
index b3f2157..21f74d6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -54,3 +54,4 @@ lto = true
 codegen-units = 1
 panic = "unwind"
 strip = true
+overflow-checks = true
diff --git a/tests/integration_test.rs b/tests/integration_test.rs
index 236a903..2e7d082 100644
--- a/tests/integration_test.rs
+++ b/tests/integration_test.rs
@@ -1790,3 +1790,20 @@ async fn test_k03_passwd_sheet_remains_valid_and_rekey_revokes_old_sheet() {
     // Aufräumen
     let _ = std::fs::remove_file(&container_path);
 }
+
+#[test]
+fn test_m02_release_profile_enables_overflow_checks() {
+    let cargo_toml = std::fs::read_to_string("Cargo.toml").expect("Read Cargo.toml");
+    let release_section = cargo_toml
+        .split("[profile.release]")
+        .nth(1)
+        .expect("Must have [profile.release] section");
+    let release_block = release_section
+        .split('[')
+        .next()
+        .unwrap_or(release_section);
+    assert!(
+        release_block.contains("overflow-checks = true"),
+        "M-02: [profile.release] must explicitly set overflow-checks = true to prevent integer overflow vulnerabilities"
+    );
+}