1dot13/source
1
0
Fork 0
mirror of https://github.com/1dot13/source.git synced 2026-09-16 14:47:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

Prevent writing past array capacity (#185)

Browse Source 
Game would crash with stack-based buffer overrun when a MOLLE item had enough attachments and their texts were written past attachString capacity
This commit is contained in:
Asdow
2023-07-25 14:19:30 +03:00
committed by GitHub
parent 06d4b53d3e
commit 2163a66169
1 changed files with 24 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Tactical/Interface Items.cpp
+24 -13
View File
@@ -12648,28 +12648,39 @@ void GetHelpTextForItem( STR16 pzStr, OBJECTTYPE *pObject, SOLDIERTYPE *pSoldier
// Add attachment string.... // Add attachment string....
CHAR16 attachString[ 300 ]; CHAR16 attachString[ 300 ];
CHAR16 tempString[ 120 ];
memset(attachString,0,sizeof(attachString)); memset(attachString,0,sizeof(attachString));
for (attachmentList::iterator iter = (*pObject)[subObject]->attachments.begin(); iter != (*pObject)[subObject]->attachments.end(); ++iter) { for (attachmentList::iterator iter = (*pObject)[subObject]->attachments.begin(); iter != (*pObject)[subObject]->attachments.end(); ++iter)
if(iter->exists()){ {
if(iter->exists())
//Break off if it's too long. {
if(wcslen(attachString)>270){ memset(tempString, 0, sizeof(tempString));
wcscat( attachString, L"\n...." );
break;
}
iNumAttachments++; iNumAttachments++;
if (iNumAttachments == 1)
if ( iNumAttachments == 1 )
{ {
swprintf( attachString, L"\n \n%s:\n", Message[ STR_ATTACHMENTS ] ); swprintf(tempString, L"\n \n%s:\n", Message[STR_ATTACHMENTS]);
} }
else else
{ {
wcscat( attachString, L"\n" ); swprintf(tempString, L"\n");
} }
wcscat(tempString, ItemNames[iter->usItem]);
wcscat( attachString, ItemNames[ iter->usItem ] ); auto attachStringLength = wcslen(attachString);
auto tempStringLength = wcslen(tempString);
auto totalLength = attachStringLength + tempStringLength;
// Break off if the string to be added does not fit.
// attachStringLength[300] - L"\n...." -> 294
if (totalLength > 294)
{
wcscat(attachString, L"\n....");
break;
}
else
{
wcscat(attachString, tempString);
}
} }
} }