diff --git a/SaveLoadGame.cpp b/SaveLoadGame.cpp index c5e1f003..3fd9766f 100644 --- a/SaveLoadGame.cpp +++ b/SaveLoadGame.cpp @@ -2393,13 +2393,26 @@ BOOLEAN OBJECTTYPE::Load( HWFILE hFile ) { return(FALSE); } - int size; + + int size = 0; if ( !FileRead( hFile, &size, sizeof(int), &uiNumBytesRead ) ) { return(FALSE); } + + // WANNE: This is a safety check. + // The size can get any huge value, if we are using wrong items.xml on the savegame + // In that case, the "objectStack.resize(size) consumes ALL the memory on the system and then the game crashes because of not enough free memory!!!! + // When returning FALSE well tell there is something wrong and we can't load the savegame + if (size < 0 || size > 1000) + { + return(FALSE); + } + // WANNE.MEMORY: This call takes all the pc memory if we pass an invalid huge size as a parameter. See previous safety check. objectStack.resize(size); + + int x = 0; for (StackedObjects::iterator iter = objectStack.begin(); iter != objectStack.end(); ++iter, ++x) { if (! iter->Load(hFile)) { @@ -2412,6 +2425,7 @@ BOOLEAN OBJECTTYPE::Load( HWFILE hFile ) } } } + } else {