# Extended 5.15 — SocketPlugin: `(startIndex + count) - 1` ≤ slotSizeOf(array) wraps

Bug ref      : pharo.md §5.15
Severity     : MEDIUM (wrap-around defeats bounds check)
File         : extracted/plugins/SocketPlugin/src/common/SocketPlugin.c
Lines (HEAD) : 1795, 1858, 2060

## Problem

```c
if (((startIndex + count) - 1) <= slotSizeOf(array)) ...
```

`startIndex + count` is signed `sqInt`. Large image-controlled
values wrap negative; the bounds check then succeeds when it
should not.

## Fix

Use uint64 arithmetic with explicit non-negative preconditions.

```diff
diff --git a/extracted/plugins/SocketPlugin/src/common/SocketPlugin.c b/extracted/plugins/SocketPlugin/src/common/SocketPlugin.c
index 883c1a8b8..64c0ae3a4 100644
--- a/extracted/plugins/SocketPlugin/src/common/SocketPlugin.c
+++ b/extracted/plugins/SocketPlugin/src/common/SocketPlugin.c
@@ -1792,7 +1792,8 @@ primitiveSocketReceiveDataBufCount(void)
 	}
 	success((startIndex >= 1)
 	 && ((count >= 0)
-	 && (((startIndex + count) - 1) <= (slotSizeOf(array)))));
+	 && (startIndex >= 1 && count >= 0
+	     && ((uint64_t)startIndex + (uint64_t)count - 1 <= (uint64_t)slotSizeOf(array)))));
 	if (!(failed())) {
 
 		/* Note: adjust bufStart for zero-origin indexing */
@@ -1855,7 +1856,8 @@ primitiveSocketReceiveUDPDataBufCount(void)
 	}
 	success((startIndex >= 1)
 	 && ((count >= 0)
-	 && (((startIndex + count) - 1) <= (slotSizeOf(array)))));
+	 && (startIndex >= 1 && count >= 0
+	     && ((uint64_t)startIndex + (uint64_t)count - 1 <= (uint64_t)slotSizeOf(array)))));
 	if (!(failed())) {
 
 		/* Note: adjust bufStart for zero-origin indexing */
@@ -2057,7 +2059,8 @@ primitiveSocketSendDataBufCount(void)
 	}
 	success((startIndex >= 1)
 	 && ((count >= 0)
-	 && (((startIndex + count) - 1) <= (slotSizeOf(array)))));
+	 && (startIndex >= 1 && count >= 0
+	     && ((uint64_t)startIndex + (uint64_t)count - 1 <= (uint64_t)slotSizeOf(array)))));
 	if (!(failed())) {
 
 		/* Note: adjust bufStart for zero-origin indexing */
@@ -2152,7 +2155,8 @@ primitiveSocketSendUDPDataBufCount(void)
 	}
 	success((startIndex >= 1)
 	 && ((count >= 0)
-	 && (((startIndex + count) - 1) <= (slotSizeOf(array)))));
+	 && (startIndex >= 1 && count >= 0
+	     && ((uint64_t)startIndex + (uint64_t)count - 1 <= (uint64_t)slotSizeOf(array)))));
 	if (!(failed())) {
 
 		/* Note: adjust bufStart for zero-origin indexing */
```

Apply at 1795, 1858, 2060.

## Test plan

- Call with `startIndex = INT_MAX`, `count = 1`. Before: signed
  wrap. After: fails cleanly.

## Risk notes

- Same wrap-fix pattern used in extended 2.3, 3.4, 3.5, 3.8.