From c8f09d4ac7c3431ccd45c99b972c8dacef8cbb21 Mon Sep 17 00:00:00 2001 From: Daniel Gibson Date: Mon, 3 Mar 2025 05:22:40 +0100 Subject: [PATCH] Initialize all idRegister class members in constructors in SkinDeep regs not being initialized caused random crashes (in dhewm3 I haven't seen that so far, but fixing this won't hurt). From SkinDeep commit message: In idRegister::SetToRegs() at `registers[ regs[ i ] ] = v[i];` regs[i] contained values like 21845 or 22010 or 32272, even though the static registers array that's written to there only holds 4096 elements (it's `static float regs[MAX_EXPRESSION_REGISTERS];` from `idWindow::EvalRegs()`). So it overwrites other data, likely other global variables, like `gameLocal.entities[4967]`, that now contain garbage and next time someone tries to use them, bad things happen. In this case, if someone tries to dereference gameLocal.entities[i] and the pointer at i contains garbage, there's a segfault (crash). https://github.com/DanielGibson/SkinDeep/commit/462404af67463cdc37a4986331670e4c062118e9 --- neo/ui/RegExp.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/neo/ui/RegExp.h b/neo/ui/RegExp.h index 4cb0ae2f..6a7907d4 100644 --- a/neo/ui/RegExp.h +++ b/neo/ui/RegExp.h @@ -58,6 +58,11 @@ public: }; ID_INLINE idRegister::idRegister( void ) { + enabled = false; + type = -1; + regCount = 0; + memset(regs, 0, sizeof(regs)); + var = NULL; } ID_INLINE idRegister::idRegister( const char *p, int t ) { @@ -65,6 +70,7 @@ ID_INLINE idRegister::idRegister( const char *p, int t ) { type = t; assert( t >= 0 && t < NUMTYPES ); regCount = REGCOUNT[t]; + memset(regs, 0, sizeof(regs)); enabled = ( type == STRING ) ? false : true; var = NULL; };