@@ -2135,6 +2135,11 @@ namespace SharedUtil
21352135 {
21362136 if (uiLength < 1 )
21372137 return ;
2138+
2139+ // Check for arithmetic overflow
2140+ if (uiStart + uiLength < uiStart || uiStart + uiLength - 1 < uiStart)
2141+ return ;
2142+
21382143 uint uiLast = uiStart + uiLength - 1 ;
21392144
21402145 // Make a hole
@@ -2150,34 +2155,68 @@ namespace SharedUtil
21502155 {
21512156 if (uiLength < 1 )
21522157 return ;
2158+
2159+ // Check for arithmetic overflow
2160+ if (uiStart + uiLength < uiStart || uiStart + uiLength - 1 < uiStart)
2161+ return ;
2162+
21532163 uint uiLast = uiStart + uiLength - 1 ;
21542164
21552165 RemoveObscuredRanges (uiStart, uiLast);
2156-
21572166 IterType iterOverlap;
21582167 if (GetRangeOverlappingPoint (uiStart, iterOverlap))
21592168 {
21602169 uint uiOverlapPrevLast = iterOverlap->second ;
21612170
2162- // Modify overlapping range last point
2163- uint uiNewLast = uiStart - 1 ;
2164- iterOverlap->second = uiNewLast;
2171+ // Modify overlapping range last point with underflow check
2172+ if (uiStart > 0 )
2173+ {
2174+ uint uiNewLast = uiStart - 1 ;
2175+ iterOverlap->second = uiNewLast;
21652176
2166- if (uiOverlapPrevLast > uiLast)
2177+ if (uiOverlapPrevLast > uiLast)
2178+ {
2179+ // Need to add range after hole
2180+ // Check for overflow when calculating uiLast + 1
2181+ if (uiLast < UINT_MAX)
2182+ {
2183+ uint uiNewStart = uiLast + 1 ;
2184+ m_StartLastMap[uiNewStart] = uiOverlapPrevLast;
2185+ }
2186+ }
2187+ }
2188+ else
21672189 {
2168- // Need to add range after hole
2169- uint uiNewStart = uiLast + 1 ;
2170- m_StartLastMap[uiNewStart] = uiOverlapPrevLast;
2190+ // Special case: uiStart is 0, remove the range entirely
2191+ m_StartLastMap.erase (iterOverlap);
2192+ if (uiOverlapPrevLast > uiLast)
2193+ {
2194+ // Check for overflow when calculating uiLast + 1
2195+ if (uiLast < UINT_MAX)
2196+ {
2197+ uint uiNewStart = uiLast + 1 ;
2198+ m_StartLastMap[uiNewStart] = uiOverlapPrevLast;
2199+ }
2200+ }
21712201 }
21722202 }
21732203
21742204 if (GetRangeOverlappingPoint (uiLast, iterOverlap))
21752205 {
21762206 // Modify overlapping range start point
2177- uint uiNewStart = uiLast + 1 ;
2178- uint uiOldLast = iterOverlap->second ;
2179- m_StartLastMap.erase (iterOverlap);
2180- m_StartLastMap[uiNewStart] = uiOldLast;
2207+ // Check for overflow when calculating uiLast + 1
2208+ if (uiLast < UINT_MAX)
2209+ {
2210+ uint uiNewStart = uiLast + 1 ;
2211+ uint uiOldLast = iterOverlap->second ;
2212+ m_StartLastMap.erase (iterOverlap);
2213+ m_StartLastMap[uiNewStart] = uiOldLast;
2214+ }
2215+ else
2216+ {
2217+ // If uiLast == UINT_MAX, we can't create a range after it, just remove the overlapping range
2218+ m_StartLastMap.erase (iterOverlap);
2219+ }
21812220 }
21822221 }
21832222
@@ -2186,6 +2225,11 @@ namespace SharedUtil
21862225 {
21872226 if (uiLength < 1 )
21882227 return false ;
2228+
2229+ // Check for arithmetic overflow
2230+ if (uiStart + uiLength < uiStart || uiStart + uiLength - 1 < uiStart)
2231+ return false ;
2232+
21892233 uint uiLast = uiStart + uiLength - 1 ;
21902234
21912235 IterType iter = m_StartLastMap.lower_bound (uiStart);
0 commit comments