From 43807bdc17c027065cfca257598d6ecdc94ee1e0 Mon Sep 17 00:00:00 2001
From: sit-d <281093367+sit-d@users.noreply.github.com>
Date: Fri, 3 Jul 2026 21:13:36 -0600
Subject: [PATCH] fix: harden iterator MRU storage bounds

---
 iterator_mru_storage.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/iterator_mru_storage.c b/iterator_mru_storage.c
index b6022d9..7a1d71d 100644
--- a/iterator_mru_storage.c
+++ b/iterator_mru_storage.c
@@ -77,9 +77,10 @@ int IteratorMruLoadList(const char *name, uint32_t magic, uint32_t item_size,
         return 0;
     }
 
-    count = (int)h.count;
-    if (count > max_items)
+    if (h.count > (uint32_t)max_items)
         count = max_items;
+    else
+        count = (int)h.count;
     if (count > 0 && fread(items, item_size, (size_t)count, f) != (size_t)count) {
         fclose(f);
         return 0;
@@ -97,7 +98,7 @@ int IteratorMruSaveList(const char *name, uint32_t magic, uint32_t item_size,
     IteratorMruHeader h;
     FILE *f;
 
-    if (count < 0 || item_size == 0)
+    if (count < 0 || item_size == 0 || (count > 0 && !items))
         return 0;
 
     make_state_path(path, sizeof(path), name);