Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Investigate clientChannels[] out of bounds read/crash

Aperta
  • Qualcosa non va?
#3,926 2 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 3 giorni

@ann0see ci sta già lavorando.

Dal 27/8/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

AI bug good first issue

Describe the bug

INVALID_INDEX might not be checked everywhere correctly. AI found out that there could be an out of bounds read possiblity in client.cpp if calling SetRemoteChanGain:

https://github.com/jamulussoftware/jamulus/blob/508f1f3d3ea41b0da76da128ee5d3f3f1b2fafc7/src/client.cpp#L1020-L1031

To Reproduce

Not tested. Would probably need some server side trigger with invalid Channel ID.
Probably worth checking on the protocol level for invalid IDs.

Ox Alpha (GLM 5.3-Flash) suggested:

Guard the call site (minimal change):

if ( iChanID != INVALID_INDEX && bMuteMeInPersonalMix ) { ... }

and/or reject invalid IDs in EvaluateClientIDMes; optionally add a defensive Q_ASSERT/range check in SetRemoteChanGain/SetRemoteChanPan mirroring OnControllerInFaderLevel (client.cpp:956). Related latent gap: OnControllerInPanValue (client.cpp:965-975) lacks the bounds check its fader sibling has.

Expected behavior

No crash

AI analysis

  • src/protocol.cpp:1046-1063 (EvaluateClientIDMes) — validates only body size (1 byte); the ID value itself (0–255) is passed through unchecked.
  • src/client.cpp:1010-1036 (CClient::OnClientIDReceived):
int iChanID = FindClientChannel ( iServerChanID, true ); // should always return channel 0
...
if ( bMuteMeInPersonalMix )
{
    SetRemoteChanGain ( iChanID, 0, false );   // iChanID can be INVALID_INDEX (-1)
}
  • src/client.cpp:1833-1885 (FindClientChannel) returns INVALID_INDEX (-1) when iServerChannelID < 0 || >= MAX_NUM_CHANNELS or when all 150 client channel slots are occupied.
  • src/client.cpp:506-539 (SetRemoteChanGain): &clientChannels[iId] with no bounds check →
    • timer inactive: OOB write at client.cpp:535 (clientChan->oldGain = clientChan->newGain = fGain;) plus OOB read of iServerChannelID fed to Channel.SetRemoteChanGain() (that callee is range-checked, channel.cpp:302);
    • timer active: OOB write at client.cpp:522, and minGainOrPanId = -1 causes OnTimerRemoteChanGainOrPan (client.cpp:546-548) to iterate from index −1 afterwards.
  • clientChannels is a fixed CClientChannel[150] member array (src/client.h:392).

Contrast with the correct pattern used 700 lines earlier: OnMuteStateHasChangedReceived checks if ( iChanID != INVALID_INDEX ) (client.cpp:340-346).

Lingua principale
C
Stelle
1.1k
Fork
248
Merge medio
2g 22h
PR unite (30g)
6

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di jamulussoftware/jamulus

Tutte le issue di jamulussoftware/jamulus

Issue simili

Altre issue su C

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.