From 2cbc52e265a2a6c504c446828a4c9e921de9f33d Mon Sep 17 00:00:00 2001
From: Wanne <Wanne@3b4a5df2-a311-0410-b5c6-a8a6f20db521>
Date: Sat, 25 Jun 2011 09:53:40 +0000
Subject: [PATCH] - Fixed "out of memory" crash when loading a savegame with
 NIV and the wrong "Items.xml" files o In my case the ja2 process took ALL the
 memory (up to 2GB) and then crashed o The problem is, that the
 "objectStack.resize(size);" consumes ALL the memory when passing in invalid
 huge size to the resize method o The wrong "size" is calculated from the
 temporary files because of wrong items. Now I added a safety check on the
 size variable and if out of range ( > 1000) we simply fail loading the
 savegame instead of letting the ja2 process consume all the memory and then
 let it crash after a few minutes.

git-svn-id: https://ja2svn.mooo.com/source/ja2/trunk/GameSource/ja2_v1.13/Build@4532 3b4a5df2-a311-0410-b5c6-a8a6f20db521
---
 SaveLoadGame.cpp | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/SaveLoadGame.cpp b/SaveLoadGame.cpp
index c5e1f003..3fd9766f 100644
--- a/SaveLoadGame.cpp
+++ b/SaveLoadGame.cpp
@@ -2393,13 +2393,26 @@ BOOLEAN OBJECTTYPE::Load( HWFILE hFile )
 		{
 			return(FALSE);
 		}
-		int size;
+		
+		int size = 0;
 		if ( !FileRead( hFile, &size, sizeof(int), &uiNumBytesRead ) )
 		{
 			return(FALSE);
 		}
+		
+		// WANNE: This is a safety check.
+		// The size can get any huge value, if we are using wrong items.xml on the savegame
+		// In that case, the "objectStack.resize(size) consumes ALL the memory on the system and then the game crashes because of not enough free memory!!!!
+		// When returning FALSE well tell there is something wrong and we can't load the savegame
+		if (size < 0 || size > 1000)
+		{
+			return(FALSE);
+		}
 
+		// WANNE.MEMORY: This call takes all the pc memory if we pass an invalid huge size as a parameter. See previous safety check.
 		objectStack.resize(size);
+			
+			
 		int x = 0;
 		for (StackedObjects::iterator iter = objectStack.begin(); iter != objectStack.end(); ++iter, ++x) {
 			if (! iter->Load(hFile)) {
@@ -2412,6 +2425,7 @@ BOOLEAN OBJECTTYPE::Load( HWFILE hFile )
 				}
 			}
 		}
+		
 	}
 	else
 	{