GetParamsColon(): missing bounds check causes unsigned underflow when uIdx >= params.size() #1084

New Issue

2026-10-05T05:02:34+02:00

adam commented

2026-10-05 05:02:34 +02:00

Summary:

When uIdx >= m_vsParams.size() and the vector is non-empty, the comparison at src/Message.cpp:57:

if (uLen > m_vsParams.size() - uIdx - 1)

underflows to SIZE_MAX. No current call site passes a combination of arguments that makes this reachable in practice -the default uLen=-1 causes the loop bound to overflow harmlessly. But the check is wrong and a future caller passing an explicit uLen with an out-of-bounds uIdx would hit UB.

The fix is a single bounds check matching the one already in GetParam():

if (uIdx >= m_vsParams.size()) return "";

Same issue exists in GetParamsSplit() at src/Message.cpp:316.

## Summary: When uIdx >= m_vsParams.size() and the vector is non-empty, the comparison at src/Message.cpp:57: ` if (uLen > m_vsParams.size() - uIdx - 1)` underflows to SIZE_MAX. No current call site passes a combination of arguments that makes this reachable in practice -the default uLen=-1 causes the loop bound to overflow harmlessly. But the check is wrong and a future caller passing an explicit uLen with an out-of-bounds uIdx would hit UB. The fix is a single bounds check matching the one already in `GetParam()`: ` if (uIdx >= m_vsParams.size()) return "";` Same issue exists in `GetParamsSplit()` at `src/Message.cpp:316.`

adam closed this issue

2026-10-05 05:02:34 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#1084