Skip to content

Fix startup crash from an out-of-range customdirectoryindex - #3931

Open
mcfnord wants to merge 1 commit into
jamulussoftware:mainfrom
mcfnord:fix/customdirectoryindex-range
Open

Fix startup crash from an out-of-range customdirectoryindex#3931
mcfnord wants to merge 1 commit into
jamulussoftware:mainfrom
mcfnord:fix/customdirectoryindex-range

Conversation

@mcfnord

@mcfnord mcfnord commented Aug 30, 2026

Copy link
Copy Markdown
Contributor

🤖 AI: Fixes #3917, which @pljones asked for a PR on. The client accepts a customdirectoryindex of MAX_NUM_SERVER_ADDR_ITEMS out of the settings file and then uses it as a subscript into a vector holding exactly that many elements, so the one value past the end crashes the client at startup. The range check is one wider than the object it guards.

Short description of changes

One line in CClientSettings::ReadSettingsFromXML: the upper bound becomes MAX_NUM_SERVER_ADDR_ITEMS - 1. GetNumericIniSet's bound is inclusive, MAX_NUM_SERVER_ADDR_ITEMS is 12 and vstrDirectoryAddress holds 12 elements, so 12 was accepted and 12 is out of range. The two unguarded subscripts are in CConnectDlg::RequestServerList and the jamulusclient/getCurrentDirectory RPC method, so it is not GUI-only.

The client's own writer only ever emits 0..11, so reaching this needs a hand-edited or corrupted settings file. The range check exists to make that safe.

Both arms, built from the same tree with and without this one line, Qt 5.15.13, gcc 13.3, QT_QPA_PLATFORM=offscreen, settings file carrying directorytype 7 (AT_CUSTOM) and winviscon 1:

customdirectoryindex in the file main with this change
11 connect dialog drawn, value kept connect dialog drawn, value kept
12 SIGSEGV, exit 139, dialog never drawn connect dialog drawn, value falls back to 0

The fallback is visible in the settings file the client writes back on exit: 0 where 12 was rejected, 11 where 11 was accepted.

CHANGELOG: Client: Fixed a startup crash caused by an out-of-range custom directory index in the settings file.

Context: Fixes an issue?

Fixes: #3917

Does this change need documentation? What needs to be documented and how?

No.

Status of this Pull Request

Ready for review.

What is missing until this pull request can be merged?

Review.

Checklist

  • I've verified that this Pull Request follows the general code principles
  • I tested my code and it does what I want — evidence above
  • My code follows the style guide
  • I waited some time after this Pull Request was opened and all GitHub checks completed without errors.
  • I've filled all the content above

🤖 This message was written by AI and reviewed by @mcfnord.

GetNumericIniSet's upper bound is inclusive and MAX_NUM_SERVER_ADDR_ITEMS is
the element count of vstrDirectoryAddress, so the value one past the end was
accepted from the settings file and then used as a subscript, crashing the
client at startup in CConnectDlg::RequestServerList.

Fixes jamulussoftware#3917.

@softins softins left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks ok to me. I usually prefer the upper bound of a range check to be exclusive rather than inclusive, but this change matches the convention established by all the other uses of GetNumericIniSet()

@pljones pljones added bug Something isn't working AI AI generated or potentially AI generated backport_required A change to main that needs fix on an existing release. labels Aug 30, 2026
@github-project-automation github-project-automation Bot moved this to Triage in Tracking Aug 30, 2026
@github-project-automation github-project-automation Bot moved this from Triage to Waiting on Team in Tracking Aug 30, 2026
@pljones pljones added this to the Release 4.0.0 milestone Aug 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

AI AI generated or potentially AI generated backport_required A change to main that needs fix on an existing release. bug Something isn't working

Projects

Status: Waiting on Team

Development

Successfully merging this pull request may close these issues.

customdirectoryindex off-by-one causes SIGSEGV at client startup

3 participants