Clamp all Container stack amounts to 0..2^31-1 #47

New issue

Closed

opened 2026-06-11 14:06:25 +00:00 by sickday · 0 comments

sickday commented

2026-06-11 14:06:25 +00:00

Owner

Problem

Trade caps coin overflow, but it is unconfirmed that every Game.Item.Container add/remove (bank, ground items, general stackables) clamps amounts to the RS valid range 0..2_147_483_647. An overflow past 2^31-1 or a negative amount (crafted withdraw-X, add-to-near-max stack) can dupe or vaporize items.

Task

Audit Container.add/remove and all stack-amount arithmetic; clamp/validate to 0..2^31-1, reject or split on overflow. Property test: random add/remove sequences never produce negative or >max amounts.

Acceptance

No code path can persist a stack amount outside 0..2_147_483_647.

Refs: lib/black_lobster/game/item/container.ex and callers.

Part of the Security & Data-Integrity Hardening epic.

## Problem Trade caps coin overflow, but it is unconfirmed that **every** `Game.Item.Container` add/remove (bank, ground items, general stackables) clamps amounts to the RS valid range `0..2_147_483_647`. An overflow past 2^31-1 or a negative amount (crafted withdraw-X, add-to-near-max stack) can dupe or vaporize items. ## Task Audit `Container.add/remove` and all stack-amount arithmetic; clamp/validate to `0..2^31-1`, reject or split on overflow. Property test: random add/remove sequences never produce negative or `>max` amounts. ## Acceptance - No code path can persist a stack amount outside `0..2_147_483_647`. Refs: `lib/black_lobster/game/item/container.ex` and callers. Part of the Security & Data-Integrity Hardening epic.

sickday referenced this issue

2026-06-11 14:06:43 +00:00

Epic: Security & Data-Integrity Hardening #50

sickday added the

bug

epic:security-hardening

priority:medium

server

labels

2026-06-11 14:07:38 +00:00

sickday added this to the v1 milestone

2026-06-11 14:11:16 +00:00