Bug: in apply-patch silently swallows mismatched replacement ranges

Description

In codex-rs/apply-patch/src/lib.rs, the apply_replacements function at line 544 has a guard that silently skips removal when start_idx >= lines.len():

for _ in 0..old_len {
    if start_idx < lines.len() {
        lines.remove(start_idx);
    }
}

When start_idx >= lines.len(), the loop silently does nothing — it does not remove the expected old_len lines but still proceeds to insert new_segment at start_idx. This means a patch with a stale or incorrect range will produce silently corrupted output rather than an error.

Expected behavior

If the replacement range is out of bounds, the function should return an error rather than silently producing incorrect output.

Suggested fix

for _ in 0..old_len {
    if start_idx >= lines.len() {
        return /* error: replacement range exceeds file length */;
    }
    lines.remove(start_idx);
}

Or alternatively, validate all replacement ranges against lines.len() before entering the loop.

Environment

• Repository: openai/codex, main branch
• File: codex-rs/apply-patch/src/lib.rs, lines 539-554