tests/assets/testsprite_toomanyframes.json

{
    "spritesheet": {
        "filename": "spritesheet.png",
        "frame_width": 48,
        "frame_height": 48
    },
    "name": "testsprite_toomanyframes",
    "width": 48,
    "height": 48,
    "speed": 100,
    "loop": true,
    "loopReverse": true,
    "frames": [
        0,
        1,
        2,
        3,
        4,
        5,
        6,
        7,
        8,
        9,
        10,
        11,
        12,
        13,
        14,
        15,
        16
    ]
}
Bound every array a data file can index Closes Defects items 16 and 17 and Known-and-still-open item 6. All three let an asset file, or a caller's argument, write past a fixed array. akgl_sprite_load_json took its frame count straight from the document and wrote that many entries into a 16-byte frameids -- through a uint32_t * cast of a uint8_t , so each write touched four bytes and the overrun reached four bytes past the array, into the rest of akgl_Sprite and then the next pool slot. The count is checked first now, each id is read into an int and narrowed deliberately, and a frame number too large for a uint8_t is refused rather than truncated into an index for a different tile. The tilemap loader had the same shape twice: objects[j] with no check against AKGL_TILEMAP_MAX_OBJECTS_PER_LAYER and tilesets[i] with none against AKGL_TILEMAP_MAX_TILESETS. akgl_tilemap_load_layers already bounded its own loop, so the pattern was in the same file. The object one is the reachable half -- 128 objects is not a large object layer. akgl_string_initialize zeroed sizeof(akgl_String) starting at `data`, which begins after the refcount in front of it, so it ran four bytes past the end of the object and onto the next* slot's refcount -- the field the allocator reads to decide whether a slot is free. Same file, same class, fixed with it: akgl_string_copy accepted a count larger than the buffers, reading past one pool slot and writing past another, which the header documented as behaviour. Every case has a test that fails against the old code, with five new fixtures. Exactly-the-maximum is asserted alongside one-past in each, so the bound cannot be fixed by making the limit off by one. 25/25 pass, memcheck clean, reindent --check clean. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> 2026-08-01 00:24:35 -04:00			`{`
			`"spritesheet": {`
			`"filename": "spritesheet.png",`
			`"frame_width": 48,`
			`"frame_height": 48`
			`},`
			`"name": "testsprite_toomanyframes",`
			`"width": 48,`
			`"height": 48,`
			`"speed": 100,`
			`"loop": true,`
			`"loopReverse": true,`
			`"frames": [`
			`0,`
			`1,`
			`2,`
			`3,`
			`4,`
			`5,`
			`6,`
			`7,`
			`8,`
			`9,`
			`10,`
			`11,`
			`12,`
			`13,`
			`14,`
			`15,`
			`16`
			`]`
			`}`