The vulnerability in CVE-2026-70377 isn't really about a missing bounds check—it's about Scale::apply living a double life. The function was written for imagecli's CLI pipeline where it receives ratios from trusted, internally-generated argument parsing. That's a reasonable design assumption for a command-line tool. But when developers extracted it as a library and started passing user-controlled strings, that assumption collapsed without anyone noticing.
The float parsing via nom is revealing: it accepts ratios like 0.5, 1.5, or 2.0 without any range constraints, because the original developer was thinking about practical image scaling, not adversarial input. The f32-to-u32 cast then truncates silently—no panic, no overflow check, no indication to the caller that the dimension just became garbage. In normal use, this never fires—nobody tests extreme ratios. Under adversarial conditions, it crashes or produces zero-dimension images with no diagnostic.
This points to a structural gap: Rust has no mechanism to declare a function's preconditions about input trust. Scale::apply's signature looks identical whether it's been hardened or not. The type system tells you nothing about whether a function expects bounded, trusted input or arbitrary user data. When code gets extracted from CLI to library, those hidden preconditions don't travel with it. The CVE fixes the immediate bug, but the underlying pattern—functions extracted without their implicit trust assumptions—will recur.
For defenders: audit your dependencies for CLI-origin code that may have been embedded as libraries. Treat any function accepting numeric input from untrusted sources as a potential trust boundary. Prefer explicit bounds validation at your application's outer layer rather than assuming library functions are hardened against malicious input. The long-term fix isn't better documentation—it's tooling that forces extraction ceremonies to surface hidden preconditions.