crypto-chassis / ccapi

A header-only C++ library for interacting with crypto exchanges. Bindings for Python, Java, C#, Go, and Javascript are provided.
https://discord.gg/b5EKcp9s8T
MIT License
555 stars 192 forks source link

fix: Prevent out-of-bounds access in ceilSearch function #467

Closed obergaba closed 2 months ago

obergaba commented 2 months ago

I've noticed that when subscribing to an instrument and specifying the depth of the order book that you would like to be updated on, the calculateMarketDepthAllowedByExchange function gets called with a vector of the actually possible depths the exchange offers. This function then utilizes the ceilSearch function to determine the closest greatest market depth allowed by the exchange to the depthWanted.

In the current implementation, there is a potential issue where the function may iterate beyond the last element of the vector if the desired market depth exceeds the greatest market depth offered by the exchange.

Will leave screenshots as an attachment.

Screenshot from 2024-05-15 20-41-02 Screenshot from 2024-05-15 20-43-45

github-actions[bot] commented 2 months ago

:tada: This PR is included in version 6.7.0 :tada:

The release is available on GitHub release

Your semantic-release bot :package::rocket: