From c8cb9a0d6c28c66a359654a979032759817c1fae Mon Sep 17 00:00:00 2001
From: Sevenfm <Sevenfm@3b4a5df2-a311-0410-b5c6-a8a6f20db521>
Date: Thu, 11 Mar 2021 06:51:12 +0000
Subject: [PATCH] SetAttachmentSlotsFlag: improved code to check array bounds.

git-svn-id: https://ja2svn.mooo.com/source/ja2/trunk/GameSource/ja2_v1.13/Build@8952 3b4a5df2-a311-0410-b5c6-a8a6f20db521
---
 Tactical/Items.cpp | 34 +++++++++++++---------------------
 1 file changed, 13 insertions(+), 21 deletions(-)

diff --git a/Tactical/Items.cpp b/Tactical/Items.cpp
index 7255f3d8..57474ff5 100644
--- a/Tactical/Items.cpp
+++ b/Tactical/Items.cpp
@@ -5638,51 +5638,43 @@ BOOLEAN OBJECTTYPE::AttachObjectNAS( SOLDIERTYPE * pSoldier, OBJECTTYPE * pAttac
 }
 
 //CHRISL: Use this function to sort through Attachments.xml and Launchables.xml
-UINT64 SetAttachmentSlotsFlag(OBJECTTYPE* pObj){
+UINT64 SetAttachmentSlotsFlag(OBJECTTYPE* pObj)
+{
 	UINT64		uiSlotFlag = 0;
 	UINT32		uiLoop = 0;
 	UINT32		fItem;
 
-	if(pObj->exists()==false)
+	if (pObj->exists() == false)
 		return 0;
 
-	//Madd: Common Attachment Framework
 	UINT64 point = GetAvailableAttachmentPoint(pObj, 0);
 
-	while(1)
+	while (uiLoop < gMAXITEMS_READ && Item[uiLoop].usItemClass != 0 ||
+			uiLoop < MAXATTACHMENTS && Attachment[uiLoop][0] != 0 ||
+			uiLoop < MAXITEMS + 1 && Launchable[uiLoop][0] != 0)
 	{
-		fItem = 0;
-		//Madd: Common Attachment Framework
-		if (IsAttachmentPointAvailable(point, uiLoop, TRUE))
+		if (uiLoop > 0 && uiLoop < gMAXITEMS_READ && IsAttachmentPointAvailable(point, uiLoop, TRUE))
 		{
 			fItem = uiLoop;
-			if(fItem && ItemIsLegal(fItem, TRUE))	// We've found a valid attachment.  Set the nasAttachmentSlots flag appropriately
+			if (fItem && ItemIsLegal(fItem, TRUE))
 				uiSlotFlag |= Item[fItem].nasAttachmentClass;
 		}
 
-		if (Attachment[uiLoop][1] == pObj->usItem)
+		if (uiLoop < MAXATTACHMENTS && Attachment[uiLoop][1] == pObj->usItem)
 		{
 			fItem = Attachment[uiLoop][0];
-
-			if(fItem && ItemIsLegal(fItem, TRUE))	
+			if (fItem && ItemIsLegal(fItem, TRUE))
 				uiSlotFlag |= Item[fItem].nasAttachmentClass;
 		}
 
-		if (Launchable[uiLoop][1] == pObj->usItem )
+		if (uiLoop < MAXITEMS + 1 && Launchable[uiLoop][1] == pObj->usItem)
 		{
 			fItem = Launchable[uiLoop][0];
-
-			if(fItem && ItemIsLegal(fItem, TRUE))	
+			if (fItem && ItemIsLegal(fItem, TRUE))
 				uiSlotFlag |= Item[fItem].nasAttachmentClass;
 		}
 
-		++uiLoop;
-
-		if (Attachment[uiLoop][0] == 0 && Launchable[uiLoop][0] == 0 && Item[uiLoop].usItemClass == 0 )
-		{
-			// No more attachments to search
-			break;
-		}
+		uiLoop++;
 	}
 
 	return uiSlotFlag;