CVE-2026-31969: Postfix Decrement Bounds Check Oob

A loop reads from a pointer before performing bounds checking or checking remaining capacity, leading to potential out-of-bounds reads. Furthermore, using postfix decrement (`term-- < 0`) inside the loop causes off-by-one capacity failures, potentially leading to a one-byte buffer overflow (OOB write). Check limits before pointer dereference using a prefix d

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0C
greprules fetch cve-2026-31969-postfix-decrement-bounds-check-oob --engine opengrep

Description

A loop reads from a pointer before performing bounds checking or checking remaining capacity, leading to potential out-of-bounds reads. Furthermore, using postfix decrement (`term-- < 0`) inside the loop causes off-by-one capacity failures, potentially leading to a one-byte buffer overflow (OOB write). Check limits before pointer dereference using a prefix d