mirror/OpenRGB
1
0
Fork 0
mirror of https://github.com/CalcProgrammer1/OpenRGB.git synced 2026-07-29 06:26:15 -04:00
Code Issues Packages Projects Releases Wiki Activity

NetworkServer: reject SDK index == element count (off-by-one)

Browse Source 
The SDK LED/zone update handlers checked the client-supplied index with '>'
instead of '>=', so an index equal to the element count passed the check and
reached an out-of-bounds access:

- UpdateSingleLED: out-of-bounds write to colors[led_idx]
- UpdateZoneLEDs / UpdateZoneMode: out-of-bounds read/write on zones[zone_idx]

UpdateMode had the same off-by-one (currently harmless due to a later check),
fixed for consistency. The num_colors check stays '>' since num_colors ==
leds_count is a valid "all LEDs" request.
This commit is contained in:
Eder Sanchez
2026-07-09 23:48:43 -06:00
committed by Adam Honse
parent a0d5a985f0
commit 33ec03d129
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
NetworkServer.cpp
View File

@@ -3116,7 +3116,7 @@ NetPacketStatus NetworkServer::ProcessRequest_RGBController_UpdateSaveMode(Netwo
/*-----------------------------------------------------*\
| Check if we aren't reading beyond the list of modes. |
\*-----------------------------------------------------*/
if(((std::size_t)mode_idx) > controllers[controller_idx]->modes.size())
if(((std::size_t)mode_idx) >= controllers[controller_idx]->modes.size())
{
/*-------------------------------------------------*\
| Unlock access mutex |
@@ -3220,7 +3220,7 @@ NetPacketStatus NetworkServer::ProcessRequest_RGBController_UpdateSingleLED(Netw
/*-----------------------------------------------------*\
| Check if we aren't reading beyond the list of leds. |
\*-----------------------------------------------------*/
if(((size_t)led_idx) > controllers[controller_idx]->leds.size())
if(((size_t)led_idx) >= controllers[controller_idx]->leds.size())
{
/*-------------------------------------------------*\
| Unlock access mutex |
@@ -3303,7 +3303,7 @@ NetPacketStatus NetworkServer::ProcessRequest_RGBController_UpdateZoneLEDs(Netwo
/*-----------------------------------------------------*\
| Check if we aren't reading beyond the list of zones. |
\*-----------------------------------------------------*/
if(((std::size_t)zone_idx) > controllers[controller_idx]->zones.size())
if(((std::size_t)zone_idx) >= controllers[controller_idx]->zones.size())
{
/*-------------------------------------------------*\
| Unlock access mutex |
@@ -3409,7 +3409,7 @@ NetPacketStatus NetworkServer::ProcessRequest_RGBController_UpdateZoneMode(Netwo
/*-----------------------------------------------------*\
| Check if we aren't reading beyond the list of modes. |
\*-----------------------------------------------------*/
if((((std::size_t)zone_idx) > controllers[controller_idx]->zones.size()) || (mode_idx > (int)controllers[controller_idx]->zones[zone_idx].modes.size()))
if((((std::size_t)zone_idx) >= controllers[controller_idx]->zones.size()) || (mode_idx > (int)controllers[controller_idx]->zones[zone_idx].modes.size()))
{
/*-------------------------------------------------*\
| Unlock access mutex |