validate arg indirect attribute before indexing direction array

Author: Nussu06

lib/library.cpp

@@ -932,6 +932,8 @@ Library::Error Library::loadFunction(const tinyxml2::XMLElement * const node, co
                 }
                 if (const char* const argIndirect = functionnode->Attribute("indirect")) {
                     const int indirect = strToInt<int>(argIndirect);
+                    if (indirect < 0 || indirect >= static_cast<int>(ac.direction.size()))
+                        return Error(ErrorCode::BAD_ATTRIBUTE_VALUE, argIndirect);
                     ac.direction[indirect] = dir; // TODO: handle multiple directions/indirect levels
                 }
                 else

test/testlibrary.cpp

@@ -1156,6 +1156,23 @@ class TestLibrary : public TestFixture {
 
         // comma followed by dot
         LOADLIB_ERROR_INVALID_RANGE("-10:0,.5:");
+
+        // arg indirect out of range (index into ArgumentChecks::direction)
+        LOADLIBERROR("<?xml version=\"1.0\"?>\n"
+                     "<def>\n"
+                     "  <function name=\"foo\">\n"
+                     "    <arg nr=\"1\" direction=\"in\" indirect=\"1000000\"/>\n"
+                     "  </function>\n"
+                     "</def>",
+                     Library::ErrorCode::BAD_ATTRIBUTE_VALUE);
+
+        LOADLIBERROR("<?xml version=\"1.0\"?>\n"
+                     "<def>\n"
+                     "  <function name=\"foo\">\n"
+                     "    <arg nr=\"1\" direction=\"out\" indirect=\"-5\"/>\n"
+                     "  </function>\n"
+                     "</def>",
+                     Library::ErrorCode::BAD_ATTRIBUTE_VALUE);
     }
 
     void loadLibCombinations() const {