filters: fix potential out-of-bound read

.github/workflows/docker-build.yml

@@ -5,20 +5,20 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: docker/login-action@v1
+      - uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/login-action@v1
+      - uses: docker/login-action@v3
         if: 0
         with:
           username: voidic
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
-      - uses: docker/setup-qemu-action@v1
-      - uses: docker/setup-buildx-action@v1
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
       - name: Build the Docker image
         run: docker buildx build -t ghcr.io/${{ github.repository_owner }}/strfry:latest --platform linux/amd64 --platform linux/arm64 --push .

.github/workflows/ubuntu.yml

@@ -15,7 +15,7 @@ jobs:
       - name: Build strfry
         run: |
           sudo apt update && sudo apt install -y --no-install-recommends \
-          git g++ make pkg-config libtool ca-certificates \
+          build-essential git g++ make pkg-config libtool ca-certificates \
           libssl-dev zlib1g-dev liblmdb-dev libflatbuffers-dev libsecp256k1-dev libzstd-dev
           git submodule update --init
           make setup-golpe
@@ -34,7 +34,7 @@ jobs:
           echo "filename=$filename" >> $GITHUB_ENV
 
       - name: Upload strfry deb
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: ${{ env.filename }}
           path: ${{ env.filename }}

src/filters.h

@@ -32,7 +32,8 @@ struct FilterSetBytes {
         for (size_t i = 0; i < arr.size(); i++) {
             const auto &item = arr[i];
             if (i > 0 && item == arr[i - 1]) continue; // remove duplicates
-            items.emplace_back(Item{ (uint16_t)buf.size(), (uint8_t)item.size(), (uint8_t)item[0] });
+            uint8_t first = item.empty() ? 0 : (uint8_t)item[0];
+            items.emplace_back(Item{ (uint16_t)buf.size(), (uint8_t)item.size(), first });
             buf += item;
         }