From 179b53415a6985efcee1741d85b0402a244d9c4f Mon Sep 17 00:00:00 2001 From: Sang Woo Kim Date: Fri, 17 Jul 2026 00:37:20 +0900 Subject: [PATCH] NDPluginAttrPlot: fix off-by-one that grows attribute list past its buffers rebuild_attributes() discovered attributes with the loop guard attr != NULL && attributes_.size() <= n_attributes_ The size is tested before the push_back inside the body, so when attributes_.size() == n_attributes_ the condition n <= n is still true, the body runs, and one more name is appended -- leaving attributes_.size() == n_attributes_ + 1. data_ is constructed with exactly n_attributes_ circular buffers. On the next frame push_data() takes length = attributes_.size() and loops for (i < length) data_[i].push_back(...), so data_[n_attributes_] is an out-of-bounds operator[] on the buffer vector -- a heap out-of-bounds write, reachable on the first frame whenever an NDArray carries more numeric attributes than the configured n_attributes. Use < so the list is capped at exactly n_attributes_ entries, matching the buffer count. Verified with an AddressSanitizer proof driver: with <= the list reaches 5 entries against 4 buffers and data_[4].push_back triggers a heap-buffer-overflow; with < it stops at 4 and completes cleanly. --- ADApp/pluginSrc/NDPluginAttrPlot.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ADApp/pluginSrc/NDPluginAttrPlot.cpp b/ADApp/pluginSrc/NDPluginAttrPlot.cpp index 2a38e4331..b5d8a4134 100644 --- a/ADApp/pluginSrc/NDPluginAttrPlot.cpp +++ b/ADApp/pluginSrc/NDPluginAttrPlot.cpp @@ -160,7 +160,7 @@ void NDPluginAttrPlot::rebuild_attributes(NDAttributeList& attr_list) { attributes_.clear(); for (NDAttribute * attr = attr_list.next(NULL); - attr != NULL && attributes_.size() <= n_attributes_; + attr != NULL && attributes_.size() < n_attributes_; attr = attr_list.next(attr)) { std::string name(attr->getName()); NDAttrDataType_t type = attr->getDataType();