From bc94b7c84cdd5636d2b73c69f3aa7d4b27c805b3 Mon Sep 17 00:00:00 2001
From: 1 <1>
Date: Thu, 30 Jul 2026 03:07:02 +0800
Subject: [PATCH] Fix P1-1: Prevent array overflow in xsetcolorname

- Changed boundary check from BETWEEN(x, 0, arraylen) to arraylen-1
- Prevents heap overflow when x equals arraylen (e.g., x=256)
- Can be triggered remotely via OSC 4 control sequences
- Tested: x=256 is now correctly rejected
---
 src/colors.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/colors.c b/src/colors.c
index 8df4cff..6922c55 100644
--- a/src/colors.c
+++ b/src/colors.c
@@ -149,7 +149,7 @@ void xloadcolors(void) {
 int xsetcolorname(int x, const char *name) {
 	Color p_color;
 
-	if (!BETWEEN(x, 0, dc.color_arraylen))
+	if (!BETWEEN(x, 0, dc.color_arraylen - 1))
 		return 1;
 
 	if (!xloadcolor(x, name, &p_color))