From 9f8c9624f5cfc6d1d0579e6e6b28d9c223570cb7 Mon Sep 17 00:00:00 2001
From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Tue, 26 May 2026 01:52:13 +0000
Subject: [PATCH] Fix reported integer underflow. No existing patterns affected

---
 CHANGELOG       |  4 ++++
 service_scan.cc | 22 ++++++++--------------
 2 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 8c6c19dac..2ae39fee9 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,9 @@
 #Nmap Changelog ($Id$); -*-text-*-
 
+o Fixed an integer underflow in service_scan.cc that would cause little-endian
+  integers extracted from the beginning of a service banner to be interpreted
+  as 0. Discovered with AFL++ by Malek Althubiany.
+
 o [NSE][GH#3250][GH#3206] Fix assertion failures in cases where connect or send
   returns immediately with a status other than ERROR, e.g. TIMEOUT or CANCELED.
   [Daniel Miller]
diff --git a/service_scan.cc b/service_scan.cc
index 4224955e2..001eff7ae 100644
--- a/service_scan.cc
+++ b/service_scan.cc
@@ -817,7 +817,6 @@ static char *substvar(char *tmplvar, char **tmplvarend,
   } else if (strcmp(substcommand, "I") == 0 ){
     // Parse an unsigned int
     long long unsigned val = 0;
-    bool bigendian = true;
     char buf[24]; //0xffffffffffffffff = 18446744073709551615, 20 chars
     int buflen;
     if (command_args.num_args != 2 ||
@@ -839,25 +838,20 @@ static char *substvar(char *tmplvar, char **tmplvarend,
       return NULL;
     }
     switch (command_args.str_args[1][0]) {
-      case '>':
-        bigendian = true;
+      case '>': // big endian
+        for(PCRE2_SIZE i=offstart; i < offend; i++) {
+          val = (val<<8) + subject[i];
+        }
         break;
-      case '<':
-        bigendian = false;
+      case '<': // little endian
+        for(PCRE2_SIZE i=offend; i > offstart; i--) {
+          val = (val<<8) + subject[i-1];
+        }
         break;
       default:
         return NULL;
         break;
     }
-    if (bigendian) {
-      for(PCRE2_SIZE i=offstart; i < offend; i++) {
-        val = (val<<8) + subject[i];
-      }
-    } else {
-      for(PCRE2_SIZE i=offend - 1; i > offstart - 1; i--) {
-        val = (val<<8) + subject[i];
-      }
-    }
     buflen = Snprintf(buf, sizeof(buf), "%llu", val);
     if (buflen < 0 || buflen >= (int) sizeof(buf)) {
       return NULL;