test: corrupt a documented tree threshold offset in the non-finite blob test

Parse the tree blob header and corrupt exactly the first node's threshold
(f32), leaving all framing/integrity fields intact, so the test isolates
rd_f32()'s non-finite rejection rather than passing on an unrelated malformed
blob. Covers both NaN and infinity.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: mstrathman

tests/test_fit.py

@@ -116,23 +116,32 @@ def test_predict_rejects_corrupt_blob(db):
 
 
 def test_predict_rejects_nonfinite_float_in_blob(db):
-    """A crafted blob can encode NaN/Inf floats (tree thresholds/values/conf).
-    Those must be rejected (PREDICT_ERR_SCHEMA), never flow into a prediction."""
+    """A crafted blob can encode NaN/Inf floats. Corrupt exactly one documented
+    float field (the first tree node's threshold), leaving every framing and
+    integrity field intact, so the only reason predict() can fail is rd_f32()
+    rejecting the non-finite value. Tree blob layout (predict-student.c):
+    magic 'PSTREE01' (8), task/nfeat/nclass/n_nodes (u32 x4), then length-prefixed
+    feat_names and labels, then nodes: feature (u32), threshold (f32), ..."""
     import math
     import struct
 
     _seed(db)
-    blob = db.execute("SELECT fit(tenure, spend, churned) FROM h").fetchone()[0]
-    buf = bytearray(blob)
-    # scan from the end (the node-float region) for a real fractional weight
-    off = next(
-        (i for i in range(len(buf) - 4, 8, -1)
-         if math.isfinite((v := struct.unpack_from("<f", buf, i)[0]))
-         and v != int(v) and 1e-4 < abs(v) < 1e6),
-        None,
-    )
-    assert off is not None, "no float field found to corrupt"
-    buf[off:off + 4] = struct.pack("<f", float("nan"))
-    with pytest.raises(sqlite3.OperationalError) as e:
-        db.execute("SELECT predict(?, 2, 20)", (bytes(buf),)).fetchall()
-    assert "PREDICT_ERR_SCHEMA" in str(e.value)
+    blob = db.execute(
+        "SELECT fit(tenure, spend, churned, '{\"kind\":\"tree\"}') FROM h"
+    ).fetchone()[0]
+    assert blob[:8] == b"PSTREE01"
+    p = 8
+    _task, nfeat, nclass, n_nodes = struct.unpack_from("<IIII", blob, p)
+    p += 16
+    for _ in range(nfeat + nclass):  # skip feat_names then labels (u32 len + bytes)
+        (ln,) = struct.unpack_from("<I", blob, p)
+        p += 4 + ln
+    assert n_nodes >= 1
+    p += 4  # skip node[0].feature (u32); p now points at node[0].threshold (f32)
+    assert math.isfinite(struct.unpack_from("<f", blob, p)[0])  # a real float field
+    for bad in (float("nan"), float("inf")):
+        buf = bytearray(blob)
+        struct.pack_into("<f", buf, p, bad)  # only the threshold changes
+        with pytest.raises(sqlite3.OperationalError) as e:
+            db.execute("SELECT predict(?, 2, 20)", (bytes(buf),)).fetchall()
+        assert "PREDICT_ERR_SCHEMA" in str(e.value)