Skip to content

Fix size_t underflow in TabsBase::remove bounds check - #385

Merged
texus merged 1 commit into
texus:1.xfrom
94xhn:fix-tabsbase-remove-underflow
Jul 16, 2026
Merged

Fix size_t underflow in TabsBase::remove bounds check#385
texus merged 1 commit into
texus:1.xfrom
94xhn:fix-tabsbase-remove-underflow

Conversation

@94xhn

@94xhn 94xhn commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

Problem

`TabsBase::remove(std::size_t index)` checks bounds like this:

```cpp
if (index > m_tabs.size() - 1)
return false;
```

When `m_tabs` is empty, `m_tabs.size() - 1` underflows (unsigned) to `SIZE_MAX`, so the check never returns `false` and execution falls through to:

```cpp
m_tabs.erase(m_tabs.cbegin() + static_caststd::ptrdiff_t(index));
```

which erases from an empty vector at an out-of-range position, invoking undefined behavior (crashes both in a plain optimized build and under `_GLIBCXX_DEBUG`).

Both `Tabs` and `VerticalTabs` inherit `remove()` from `TabsBase` without overriding it, and the header doc comment for this function promises "false is returned when the index was too high" — a promise this code breaks precisely in the empty-container case.

Fix

Rewrite the bounds check as `index >= m_tabs.size()`, which is safe for the empty case and matches the equivalent checks already used elsewhere in the codebase (e.g. `BoxLayout::remove`, `ListBox::removeItemByIndex`, `TabContainer::removeTab`).

Testing

Extracted the exact erase/bounds logic into a standalone reproduction: calling `remove(0)` on an empty container segfaults with the old `> size() - 1` check (both under `-O2` and under `_GLIBCXX_DEBUG`), and correctly returns `false` with no crash after applying this fix.

When m_tabs is empty, m_tabs.size() - 1 underflows to SIZE_MAX,
so the bounds check never triggers and remove() falls through to
erase() on an empty vector, causing a crash.

Use index >= m_tabs.size() instead, matching the pattern already
used by BoxLayout::remove, ListBox::removeItemByIndex and
TabContainer::removeTab elsewhere in the codebase.
@texus
texus merged commit 500011e into texus:1.x Jul 16, 2026
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants