From 608393867a1aff88ca548ca3776eb05a3dac5774 Mon Sep 17 00:00:00 2001 From: Andrea Mazzoleni Date: Mon, 17 Aug 2026 10:12:03 +0200 Subject: [PATCH] Fix undefined behavior in STREAM buffer bounds checking by avoiding out-of-bounds pointer arithmetic --- cmdline/stream.c | 2 +- cmdline/stream.h | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/cmdline/stream.c b/cmdline/stream.c index 3d8e82fb..8cd32d9b 100644 --- a/cmdline/stream.c +++ b/cmdline/stream.c @@ -277,7 +277,7 @@ int sdeplete(STREAM* s, unsigned char* last) while (1) { /* increase the position up to 4 bytes before the end */ - if (s->pos + 4 <= s->end) + if (s->end - s->pos >= 4) s->pos = s->end - 4; /* insert the last 4 bytes */ diff --git a/cmdline/stream.h b/cmdline/stream.h index 379e6881..5c9146ed 100644 --- a/cmdline/stream.h +++ b/cmdline/stream.h @@ -152,9 +152,10 @@ uint32_t scrc_stream(STREAM* s); /** * Check if the buffer has enough data loaded. */ -static inline int sptrlookup(STREAM* s, ssize_t size) +static inline int sptrlookup(STREAM* s, size_t size) { - return s->pos + size <= s->end; + /* compute remaining distance to avoid pointer arithmetic out of buffer bounds */ + return size <= (size_t)(s->end - s->pos); } /**