Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

Investigate clientChannels[] out of bounds read/crash

Aberta
  • Algo errado?
#3,926 4 comentários 0 reações 1 responsável Ver no GitHub

Mantenedores costumam responder em até 6 dias

@ann0see já está trabalhando nisso.

Desde 27/8/2026.

  • #3970 de @JohnZ622 — aberto

Avaliação

Esta issue ainda não foi avaliada.

Descrição

AI bug good first issue

Describe the bug

INVALID_INDEX might not be checked everywhere correctly. AI found out that there could be an out of bounds read possiblity in client.cpp if calling SetRemoteChanGain:

https://github.com/jamulussoftware/jamulus/blob/508f1f3d3ea41b0da76da128ee5d3f3f1b2fafc7/src/client.cpp#L1020-L1031

To Reproduce

Not tested. Would probably need some server side trigger with invalid Channel ID.
Probably worth checking on the protocol level for invalid IDs.

Ox Alpha (GLM 5.3-Flash) suggested:

Guard the call site (minimal change):

if ( iChanID != INVALID_INDEX && bMuteMeInPersonalMix ) { ... }

and/or reject invalid IDs in EvaluateClientIDMes; optionally add a defensive Q_ASSERT/range check in SetRemoteChanGain/SetRemoteChanPan mirroring OnControllerInFaderLevel (client.cpp:956). Related latent gap: OnControllerInPanValue (client.cpp:965-975) lacks the bounds check its fader sibling has.

Expected behavior

No crash

AI analysis

  • src/protocol.cpp:1046-1063 (EvaluateClientIDMes) — validates only body size (1 byte); the ID value itself (0–255) is passed through unchecked.
  • src/client.cpp:1010-1036 (CClient::OnClientIDReceived):
int iChanID = FindClientChannel ( iServerChanID, true ); // should always return channel 0
...
if ( bMuteMeInPersonalMix )
{
    SetRemoteChanGain ( iChanID, 0, false );   // iChanID can be INVALID_INDEX (-1)
}
  • src/client.cpp:1833-1885 (FindClientChannel) returns INVALID_INDEX (-1) when iServerChannelID < 0 || >= MAX_NUM_CHANNELS or when all 150 client channel slots are occupied.
  • src/client.cpp:506-539 (SetRemoteChanGain): &clientChannels[iId] with no bounds check →
    • timer inactive: OOB write at client.cpp:535 (clientChan->oldGain = clientChan->newGain = fGain;) plus OOB read of iServerChannelID fed to Channel.SetRemoteChanGain() (that callee is range-checked, channel.cpp:302);
    • timer active: OOB write at client.cpp:522, and minGainOrPanId = -1 causes OnTimerRemoteChanGainOrPan (client.cpp:546-548) to iterate from index −1 afterwards.
  • clientChannels is a fixed CClientChannel[150] member array (src/client.h:392).

Contrast with the correct pattern used 700 lines earlier: OnMuteStateHasChangedReceived checks if ( iChanID != INVALID_INDEX ) (client.cpp:340-346).

Linguagem predominante
C
Estrelas
1.1k
Forks
249
Merge médio
11d 40min
PRs com merge (30d)
6

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de jamulussoftware/jamulus

Todas as issues de jamulussoftware/jamulus

Issues semelhantes

Mais issues de C

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.