From d61323b8c25d5072c1d50f9b560436fb88f50bfb Mon Sep 17 00:00:00 2001
From: nussaiba shaikh <nussaibah@bugqore.com>
Date: Sun, 13 Sep 2026 18:10:05 +0530
Subject: [PATCH] validate arg indirect attribute before indexing direction
 array

---
 lib/library.cpp      |  2 ++
 test/testlibrary.cpp | 17 +++++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/lib/library.cpp b/lib/library.cpp
index 4e542bc55ef..6c80e88e5cc 100644
--- a/lib/library.cpp
+++ b/lib/library.cpp
@@ -932,6 +932,8 @@ Library::Error Library::loadFunction(const tinyxml2::XMLElement * const node, co
                 }
                 if (const char* const argIndirect = functionnode->Attribute("indirect")) {
                     const int indirect = strToInt<int>(argIndirect);
+                    if (indirect < 0 || indirect >= static_cast<int>(ac.direction.size()))
+                        return Error(ErrorCode::BAD_ATTRIBUTE_VALUE, argIndirect);
                     ac.direction[indirect] = dir; // TODO: handle multiple directions/indirect levels
                 }
                 else
diff --git a/test/testlibrary.cpp b/test/testlibrary.cpp
index 28264a02a53..aa2df6a0ef2 100644
--- a/test/testlibrary.cpp
+++ b/test/testlibrary.cpp
@@ -1156,6 +1156,23 @@ class TestLibrary : public TestFixture {
 
         // comma followed by dot
         LOADLIB_ERROR_INVALID_RANGE("-10:0,.5:");
+
+        // arg indirect out of range (index into ArgumentChecks::direction)
+        LOADLIBERROR("<?xml version=\"1.0\"?>\n"
+                     "<def>\n"
+                     "  <function name=\"foo\">\n"
+                     "    <arg nr=\"1\" direction=\"in\" indirect=\"1000000\"/>\n"
+                     "  </function>\n"
+                     "</def>",
+                     Library::ErrorCode::BAD_ATTRIBUTE_VALUE);
+
+        LOADLIBERROR("<?xml version=\"1.0\"?>\n"
+                     "<def>\n"
+                     "  <function name=\"foo\">\n"
+                     "    <arg nr=\"1\" direction=\"out\" indirect=\"-5\"/>\n"
+                     "  </function>\n"
+                     "</def>",
+                     Library::ErrorCode::BAD_ATTRIBUTE_VALUE);
     }
 
     void loadLibCombinations() const {