From 6f5a0d0e90b665f60d74fca38656ad1e814a0408 Mon Sep 17 00:00:00 2001
From: Cody Henthorne <cody@signal.org>
Date: Thu, 30 Jul 2026 16:18:17 -0400
Subject: [PATCH] Prevent integer overflow in body-range for mention rendering.

---
 .../org/thoughtcrime/securesms/database/MentionUtil.java | 2 +-
 .../securesms/notifications/v2/NotificationItem.kt       | 9 +++++++--
 .../thoughtcrime/securesms/database/MentionUtilTest.kt   | 9 +++++++++
 3 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/app/src/main/java/org/thoughtcrime/securesms/database/MentionUtil.java b/app/src/main/java/org/thoughtcrime/securesms/database/MentionUtil.java
index bbdf6f7d02..aca5ed74e0 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/database/MentionUtil.java
+++ b/app/src/main/java/org/thoughtcrime/securesms/database/MentionUtil.java
@@ -131,7 +131,7 @@ public final class MentionUtil {
     int start  = mention.getStart();
     int length = mention.getLength();
 
-    return start < 0 || length < 0 || (start + length) > body.length();
+    return start < 0 || length < 0 || ((long) start + length) > body.length();
   }
 
   public static class UpdatedBodyAndMentions {
diff --git a/app/src/main/java/org/thoughtcrime/securesms/notifications/v2/NotificationItem.kt b/app/src/main/java/org/thoughtcrime/securesms/notifications/v2/NotificationItem.kt
index 1f4292dd58..ee961c4d3f 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/notifications/v2/NotificationItem.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/notifications/v2/NotificationItem.kt
@@ -193,9 +193,14 @@ sealed class NotificationItem(val threadRecipient: Recipient, protected val reco
 
     if (spoilerRanges?.isNotEmpty() == true) {
       for (spoiler in spoilerRanges) {
+        val startIndex = spoiler.start.coerceAtMost(updatedText.length - 1).coerceAtLeast(0)
+        val endIndex = (spoiler.start.toLong() + spoiler.length)
+          .coerceIn(0L, updatedText.length.toLong())
+          .toInt()
+          .coerceAtLeast(startIndex)
         updatedText = updatedText.replaceRange(
-          startIndex = spoiler.start.coerceAtMost(updatedText.length - 1).coerceAtLeast(0),
-          endIndex = (spoiler.start + spoiler.length).coerceAtMost(updatedText.length).coerceAtLeast(0),
+          startIndex = startIndex,
+          endIndex = endIndex,
           replacement = "■■■■"
         )
       }
diff --git a/app/src/test/java/org/thoughtcrime/securesms/database/MentionUtilTest.kt b/app/src/test/java/org/thoughtcrime/securesms/database/MentionUtilTest.kt
index 098d5d75a5..d068e088e5 100644
--- a/app/src/test/java/org/thoughtcrime/securesms/database/MentionUtilTest.kt
+++ b/app/src/test/java/org/thoughtcrime/securesms/database/MentionUtilTest.kt
@@ -45,4 +45,13 @@ class MentionUtilTest {
 
     assertThat(update.body.toString()).isEqualTo("RecipientId::1est")
   }
+
+  @Test
+  fun overflowingRangeIsIgnored() {
+    val mentions = listOf(Mention(RecipientId.from(1L), 1, Int.MAX_VALUE))
+
+    val update: MentionUtil.UpdatedBodyAndMentions = MentionUtil.update("hi there", mentions) { it.recipientId.toString() }
+
+    assertThat(update.body.toString()).isEqualTo("hi there")
+  }
 }