From 3ab535f8a6b4c12d3f3693537dec498d52ed0436 Mon Sep 17 00:00:00 2001 From: Levi Neely Date: Tue, 3 Mar 2026 12:36:13 +0100 Subject: [PATCH] Fix integer underflow in prpc.c handler dispatch cbidx = request->type - 20 computed before checking lower bound. If request->type < calbacks_lower_band, cbidx wraps to large value causing out-of-bounds array access. Move bounds check before subtraction and use calbacks_lower_band instead of hardcoded 20. Fixes GH #235 --- pclsync/prpc.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pclsync/prpc.c b/pclsync/prpc.c index faea6dc..038bc6e 100644 --- a/pclsync/prpc.c +++ b/pclsync/prpc.c @@ -160,17 +160,17 @@ static void respond_api(rpc_message_t *request, rpc_message_t *response, size_t int cbidx; // callback index (based on message type) int cbret; // callback return value - cbidx = request->type - 20; - cbret = 0; - - if (!handlers_running || (request->type >= ((uint32_t)calbacks_lower_band + - (uint32_t)handlers_size))) { + if (!handlers_running || request->type < (uint32_t)calbacks_lower_band || + request->type >= ((uint32_t)calbacks_lower_band + (uint32_t)handlers_size)) { response->type = 13; snprintf(response->value, available_space, "Invalid type."); pdbg_logf(D_NOTICE, "Invalid request type: %u", request->type); return; } + cbidx = request->type - calbacks_lower_band; + cbret = 0; + if (!handlers[cbidx]) { response->type = 13; snprintf(response->value, available_space,