From 59fdda38350f18c910a0c2aa78ea96d298afdfd2 Mon Sep 17 00:00:00 2001 From: rustdesk Date: Tue, 8 Sep 2026 11:52:06 +0800 Subject: [PATCH] file transfer: a send_confirm past the last file no longer panics `set_stream_offset` indexed `self.files` directly. Its only guard is the `self.file_num() == r.file_num` check in `confirm()`, and `file_num` counts up past every file, so it equals `files.len()` once the job is done -- read_frame at :849 treats exactly that value as "job done". A peer that then sends `send_confirm` with the matching file_num and a non-zero OffsetBlk gets through the equality check and off the end of the slice. Every other site indexing `files` in this file already bounds-checks; this was the one that did not. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01EZ49AbZJYfm8NTp5yDPMab --- libs/base/src/fs.rs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libs/base/src/fs.rs b/libs/base/src/fs.rs index 96f377200..1adb59077 100644 --- a/libs/base/src/fs.rs +++ b/libs/base/src/fs.rs @@ -1106,6 +1106,9 @@ impl TransferJob { } async fn set_stream_offset(&mut self, file_num: usize, offset: u64) { + if file_num >= self.files.len() { + return; + } if let DataSource::FilePath(p) = &self.data_source { let entry = &self.files[file_num]; let Some(path) = self.resolve_entry_path(p, &entry.name) else {