Fix clipboard buffer overrun vulnerability (CVE-2026-41476)

CLAUDE.md

@@ -1,5 +1,13 @@
 # Synergy — collaboration notes
 
+## Working style
+
+- **Never configure or build unless explicitly asked.** No `cmake`, `cmake --build`, `make`, `ninja`, etc. After code changes, stop at the edit and ask the user to build manually.
+
+## GitHub Actions
+
+- `matrix` context is NOT available in job-level `if` — the `if` runs before the matrix is expanded. Use step-level `if` conditions instead (e.g. set a `skip` output in a setup step and check it per-step).
+
 ## Code style
 
 - Default to **no comments**. Only add one when the WHY is non-obvious — hidden constraints, subtle invariants, workarounds for specific bugs, behavior that would surprise a reader. Never add comments that explain WHAT or HOW (well-named identifiers do that).

src/lib/deskflow/IClipboard.cpp

@@ -17,6 +17,7 @@
  */
 
 #include "deskflow/IClipboard.h"
+#include "base/Log.h"
 #include "common/stdvector.h"
 
 //
@@ -28,17 +29,28 @@
   assert(clipboard != NULL);
 
   const char *index = data.data();
+  const char *const end = index + data.size();
 
   if (clipboard->open(time)) {
     // clear existing data
     clipboard->empty();
 
     // read the number of formats
     const UInt32 numFormats = readUInt32(index);
+    if (end - index < 4) {
+      LOG_ERR("clipboard unmarshall: truncated header");
+      clipboard->close();
+      return;
+    }
     index += 4;
 
     // read each format
     for (UInt32 i = 0; i < numFormats; ++i) {
+      // need 8 bytes for format id + payload size
+      if (end - index < 8) {
+        LOG_ERR("clipboard unmarshall: truncated format header at %u/%u", i, numFormats);
+        break;
+      }
       // get the format id
       IClipboard::EFormat format = static_cast<IClipboard::EFormat>(readUInt32(index));
       index += 4;
@@ -47,6 +59,12 @@
       UInt32 size = readUInt32(index);
       index += 4;
 
+      // peer-supplied size must not exceed remaining buffer
+      if (size > static_cast<UInt32>(end - index)) {
+        LOG_ERR("clipboard unmarshall: payload size %u exceeds remaining %zd", size, end - index);
+        break;
+      }
+
       // save the data if it's a known format.  if either the client
       // or server supports more clipboard formats than the other
       // then one of them will get a format >= kNumFormats here.