From dcdaaafe80e4b96eec60ba4425a3a2e0118847b8 Mon Sep 17 00:00:00 2001 From: Jeff Quast Date: Sat, 22 Aug 2026 14:05:42 +0000 Subject: [PATCH] Fix off-by-one out-of-bounds access in voteProblems PROBNUM is 10 and both problemVotes and the problemTable parameter are 10-element arrays, and the wrap check used `problem > PROBNUM`, which lets problem reach 10 and index one element past the end of both on the following iteration. Wrap at `>=`. --- packages/micropolis-engine/src/evaluate.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/micropolis-engine/src/evaluate.cpp b/packages/micropolis-engine/src/evaluate.cpp index 6d41d5e8..099d9515 100644 --- a/packages/micropolis-engine/src/evaluate.cpp +++ b/packages/micropolis-engine/src/evaluate.cpp @@ -300,7 +300,7 @@ void Micropolis::voteProblems(const short problemTable[PROBNUM]) voteCount++; } problem++; - if (problem > PROBNUM) { + if (problem >= PROBNUM) { problem = 0; } loopCount++;