From 1d81652f900d5a30fd46427d0eec0bba4e13f986 Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Sat, 6 Jun 2026 02:15:08 +0200 Subject: [PATCH] Fix out-of-bounds read in Rust derive-method synthesis MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The derive-method synthesis loop tested di_entry->methods[mi].short_name before the mi < 4 bound, so at mi==4 it read methods[4] — one past the 4-element array (UBSan: index 4 out of bounds for DeriveMethod[4]). Evaluate the mi < 4 bound first so the dereference is guarded. --- internal/cbm/lsp/rust_lsp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/internal/cbm/lsp/rust_lsp.c b/internal/cbm/lsp/rust_lsp.c index e4bdfeb60..b14d2d5fa 100644 --- a/internal/cbm/lsp/rust_lsp.c +++ b/internal/cbm/lsp/rust_lsp.c @@ -4445,10 +4445,10 @@ static void rust_build_registry_from_defs(CBMArena* arena, CBMTypeRegistry* reg, new_arr[existing + 1] = NULL; rt->embedded_types = new_arr; - /* Synthesize methods. */ + /* Synthesize methods. Bound `mi < 4` BEFORE dereferencing + * methods[mi] so we never read methods[4] (OOB). */ for (int mi = 0; - di_entry->methods[mi].short_name && - mi < 4; mi++) { + mi < 4 && di_entry->methods[mi].short_name; mi++) { const struct DeriveMethod* dm = &di_entry->methods[mi]; CBMRegisteredFunc rf; memset(&rf, 0, sizeof(rf));