From 33ec03d129a0e6885e9a416c19033e2a2de7fb63 Mon Sep 17 00:00:00 2001 From: Eder Sanchez Date: Thu, 9 Jul 2026 23:48:43 -0600 Subject: [PATCH] NetworkServer: reject SDK index == element count (off-by-one) The SDK LED/zone update handlers checked the client-supplied index with '>' instead of '>=', so an index equal to the element count passed the check and reached an out-of-bounds access: - UpdateSingleLED: out-of-bounds write to colors[led_idx] - UpdateZoneLEDs / UpdateZoneMode: out-of-bounds read/write on zones[zone_idx] UpdateMode had the same off-by-one (currently harmless due to a later check), fixed for consistency. The num_colors check stays '>' since num_colors == leds_count is a valid "all LEDs" request. --- NetworkServer.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/NetworkServer.cpp b/NetworkServer.cpp index 02a57f9ae..d8416213a 100644 --- a/NetworkServer.cpp +++ b/NetworkServer.cpp @@ -3116,7 +3116,7 @@ NetPacketStatus NetworkServer::ProcessRequest_RGBController_UpdateSaveMode(Netwo /*-----------------------------------------------------*\ | Check if we aren't reading beyond the list of modes. | \*-----------------------------------------------------*/ - if(((std::size_t)mode_idx) > controllers[controller_idx]->modes.size()) + if(((std::size_t)mode_idx) >= controllers[controller_idx]->modes.size()) { /*-------------------------------------------------*\ | Unlock access mutex | @@ -3220,7 +3220,7 @@ NetPacketStatus NetworkServer::ProcessRequest_RGBController_UpdateSingleLED(Netw /*-----------------------------------------------------*\ | Check if we aren't reading beyond the list of leds. | \*-----------------------------------------------------*/ - if(((size_t)led_idx) > controllers[controller_idx]->leds.size()) + if(((size_t)led_idx) >= controllers[controller_idx]->leds.size()) { /*-------------------------------------------------*\ | Unlock access mutex | @@ -3303,7 +3303,7 @@ NetPacketStatus NetworkServer::ProcessRequest_RGBController_UpdateZoneLEDs(Netwo /*-----------------------------------------------------*\ | Check if we aren't reading beyond the list of zones. | \*-----------------------------------------------------*/ - if(((std::size_t)zone_idx) > controllers[controller_idx]->zones.size()) + if(((std::size_t)zone_idx) >= controllers[controller_idx]->zones.size()) { /*-------------------------------------------------*\ | Unlock access mutex | @@ -3409,7 +3409,7 @@ NetPacketStatus NetworkServer::ProcessRequest_RGBController_UpdateZoneMode(Netwo /*-----------------------------------------------------*\ | Check if we aren't reading beyond the list of modes. | \*-----------------------------------------------------*/ - if((((std::size_t)zone_idx) > controllers[controller_idx]->zones.size()) || (mode_idx > (int)controllers[controller_idx]->zones[zone_idx].modes.size())) + if((((std::size_t)zone_idx) >= controllers[controller_idx]->zones.size()) || (mode_idx > (int)controllers[controller_idx]->zones[zone_idx].modes.size())) { /*-------------------------------------------------*\ | Unlock access mutex |