[mattmundell]

What

Return early when hosts->current is 0 in both branches of
gvm_hosts_move_current_host_to_end, before decrementing the index.

Why

The function decremented hosts->current unconditionally, so when it was 0
(before the first host, or with an empty set) the size_t wrapped to
SIZE_MAX and the host array was read out of bounds. The fix is needed to
avoid those reads.

Testing

• gvm_hosts_move_current_host_to_end_before_first_host (hosts-test):
  before the fix, ASan reported a heap-buffer-overflow read in
  gvm_hosts_move_current_host_to_end at base/hosts.c:1369; after the fix
  the case passes clean.
• gvm_hosts_move_current_host_to_end_empty_hosts (hosts-test): before the
  fix, ASan reported a heap-buffer-overflow read in gvm_hosts_next at
  base/hosts.c:1332; after the fix the case passes clean.

The full gvm-libs unit suite is ASan-clean with the fix.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA bc218bb.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None