ioquake/ioq3
0
0
Fork 0
mirror of https://github.com/ioquake/ioq3.git synced 2025-02-23 12:01:11 +00:00
Code Issues Projects Releases Packages Wiki Activity

more security checks in interpreter (#4249)

Browse source
This commit is contained in:
Ludwig Nussel 2009-11-01 19:58:07 +00:00
parent cc9a74a218
commit 469c986640
3 changed files with 14 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
code/qcommon/vm.c
View file

@ -245,7 +245,7 @@ void VM_LoadSymbols( vm_t *vm ) {
return; return;
} }
numInstructions = vm->instructionPointersLength >> 2; numInstructions = vm->instructionCount;
// parse the symbols // parse the symbols
text_p = mapfile.c; text_p = mapfile.c;
@ -571,8 +571,8 @@ vm_t *VM_Create( const char *module, intptr_t (*systemCalls)(intptr_t *),
} }
// allocate space for the jump targets, which will be filled in by the compile/prep functions // allocate space for the jump targets, which will be filled in by the compile/prep functions
vm->instructionPointersLength = header->instructionCount * 4; vm->instructionCount = header->instructionCount;
vm->instructionPointers = Hunk_Alloc( vm->instructionPointersLength, h_high ); vm->instructionPointers = Hunk_Alloc( vm->instructionCount*4, h_high );
// copy or compile the instructions // copy or compile the instructions
vm->codeLength = header->codeLength; vm->codeLength = header->codeLength;
@ -888,7 +888,7 @@ void VM_VmInfo_f( void ) {
Com_Printf( "interpreted\n" ); Com_Printf( "interpreted\n" );
} }
Com_Printf( " code length : %7i\n", vm->codeLength ); Com_Printf( " code length : %7i\n", vm->codeLength );
Com_Printf( " table length: %7i\n", vm->instructionPointersLength ); Com_Printf( " table length: %7i\n", vm->instructionCount*4 );
Com_Printf( " data length : %7i\n", vm->dataMask + 1 ); Com_Printf( " data length : %7i\n", vm->dataMask + 1 );
} }
} }

15
code/qcommon/vm_interpreted.c
View file

@ -438,10 +438,10 @@ nextInstruction2:
Com_Error( ERR_DROP, "OP_LOAD4 misaligned" ); Com_Error( ERR_DROP, "OP_LOAD4 misaligned" );
} }
#endif #endif
r0 = *opStack = *(int *)&image[ r0&dataMask ]; r0 = *opStack = *(int *)&image[ r0&dataMask&~3 ];
goto nextInstruction2; goto nextInstruction2;
case OP_LOAD2: case OP_LOAD2:
r0 = *opStack = *(unsigned short *)&image[ r0&dataMask ]; r0 = *opStack = *(unsigned short *)&image[ r0&dataMask&~1 ];
goto nextInstruction2; goto nextInstruction2;
case OP_LOAD1: case OP_LOAD1:
r0 = *opStack = image[ r0&dataMask ]; r0 = *opStack = image[ r0&dataMask ];
@ -462,7 +462,7 @@ nextInstruction2:
case OP_ARG: case OP_ARG:
// single byte offset from programStack // single byte offset from programStack
*(int *)&image[ codeImage[programCounter] + programStack ] = r0; *(int *)&image[ (codeImage[programCounter] + programStack)&dataMask&~3 ] = r0;
opStack--; opStack--;
programCounter += 1; programCounter += 1;
goto nextInstruction; goto nextInstruction;
@ -546,7 +546,7 @@ nextInstruction2:
Com_Printf( "%s<--- %s\n", DEBUGSTR, VM_ValueToSymbol( vm, programCounter ) ); Com_Printf( "%s<--- %s\n", DEBUGSTR, VM_ValueToSymbol( vm, programCounter ) );
} }
#endif #endif
} else if ( (unsigned)programCounter >= vm->codeLength ) { } else if ( (unsigned)programCounter >= vm->instructionCount ) {
Com_Error( ERR_DROP, "VM program counter out of range in OP_CALL" ); Com_Error( ERR_DROP, "VM program counter out of range in OP_CALL" );
} else { } else {
programCounter = vm->instructionPointers[ programCounter ]; programCounter = vm->instructionPointers[ programCounter ];
@ -615,8 +615,11 @@ nextInstruction2:
*/ */
case OP_JUMP: case OP_JUMP:
programCounter = r0; if ( (unsigned)r0 >= vm->instructionCount )
programCounter = vm->instructionPointers[ programCounter ]; Com_Error( ERR_DROP, "VM program counter out of range in OP_JUMP" );
programCounter = vm->instructionPointers[ r0 ];
opStack--; opStack--;
goto nextInstruction; goto nextInstruction;

2
code/qcommon/vm_local.h
View file

@ -154,7 +154,7 @@ struct vm_s {
int codeLength; int codeLength;
int *instructionPointers; int *instructionPointers;
int instructionPointersLength; int instructionCount;
byte *dataBase; byte *dataBase;
int dataMask; int dataMask;