From 8602c233373333dd6d39f61b8dfb9b7d172fb3e8 Mon Sep 17 00:00:00 2001
From: As9xm <197338912+As9xm@users.noreply.github.com>
Date: Thu, 10 Sep 2026 04:07:27 +0300
Subject: [PATCH] Fix atfork parent/child loop decrement causing infinite loop
 and OOB

x86emu_fork ran parent/child atfork handlers with 'for (i=0; i<sz; --i)'. With sz>0, i goes 0,-1,-2... staying <sz forever: infinite loop plus out-of-bounds atforks[i] access. The prepare loop just above correctly iterates reverse with '--i' from sz-1. Change parent/child loops to '++i' for forward iteration.
---
 src/emu/x86int3.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/emu/x86int3.c b/src/emu/x86int3.c
index 53c669553..a8f43a1cf 100755
--- a/src/emu/x86int3.c
+++ b/src/emu/x86int3.c
@@ -53,12 +53,12 @@ x86emu_t* x86emu_fork(x86emu_t* emu, int forktype)
         // error...
     } else if(v!=0) {  
         // execute atforks parent functions
-        for (int i=0; i<my_context->atfork_sz; --i)
+        for (int i=0; i<my_context->atfork_sz; ++i)
             if(my_context->atforks[i].parent)
                 EmuCall(emu, my_context->atforks[i].parent);
     } else if(v==0) {
         // execute atforks child functions
-        for (int i=0; i<my_context->atfork_sz; --i)
+        for (int i=0; i<my_context->atfork_sz; ++i)
             if(my_context->atforks[i].child)
                 EmuCall(emu, my_context->atforks[i].child);
     }