ioquake/ioq3
0
0
Fork 0
mirror of https://github.com/ioquake/ioq3.git synced 2024-11-10 07:11:46 +00:00
Code Issues Projects Releases Packages Wiki Activity

more security checks in interpreter (#4249)

Browse source
This commit is contained in:
Ludwig Nussel 2009-11-01 19:58:07 +00:00
parent cc9a74a218
commit 469c986640
3 changed files with 14 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
code/qcommon/vm.c
View file

@ -245,7 +245,7 @@ void VM_LoadSymbols( vm_t *vm ) {
return;
}
numInstructions = vm->instructionPointersLength >> 2;
numInstructions = vm->instructionCount;
// parse the symbols
text_p = mapfile.c;
@ -571,8 +571,8 @@ vm_t *VM_Create( const char *module, intptr_t (*systemCalls)(intptr_t *),
}
// allocate space for the jump targets, which will be filled in by the compile/prep functions
vm->instructionPointersLength = header->instructionCount * 4;
vm->instructionPointers = Hunk_Alloc( vm->instructionPointersLength, h_high );
vm->instructionCount = header->instructionCount;
vm->instructionPointers = Hunk_Alloc( vm->instructionCount*4, h_high );
// copy or compile the instructions
vm->codeLength = header->codeLength;
@ -888,7 +888,7 @@ void VM_VmInfo_f( void ) {
Com_Printf( "interpreted\n" );
}
Com_Printf( " code length : %7i\n", vm->codeLength );
Com_Printf( " table length: %7i\n", vm->instructionPointersLength );
Com_Printf( " table length: %7i\n", vm->instructionCount*4 );
Com_Printf( " data length : %7i\n", vm->dataMask + 1 );
}
}

15
code/qcommon/vm_interpreted.c
View file

@ -438,10 +438,10 @@ nextInstruction2:
Com_Error( ERR_DROP, "OP_LOAD4 misaligned" );
}
#endif
r0 = *opStack = *(int *)&image[ r0&dataMask ];
r0 = *opStack = *(int *)&image[ r0&dataMask&~3 ];
goto nextInstruction2;
case OP_LOAD2:
r0 = *opStack = *(unsigned short *)&image[ r0&dataMask ];
r0 = *opStack = *(unsigned short *)&image[ r0&dataMask&~1 ];
goto nextInstruction2;
case OP_LOAD1:
r0 = *opStack = image[ r0&dataMask ];
@ -462,7 +462,7 @@ nextInstruction2:
case OP_ARG:
// single byte offset from programStack
*(int *)&image[ codeImage[programCounter] + programStack ] = r0;
*(int *)&image[ (codeImage[programCounter] + programStack)&dataMask&~3 ] = r0;
opStack--;
programCounter += 1;
goto nextInstruction;
@ -546,7 +546,7 @@ nextInstruction2:
Com_Printf( "%s<--- %s\n", DEBUGSTR, VM_ValueToSymbol( vm, programCounter ) );
}
#endif
} else if ( (unsigned)programCounter >= vm->codeLength ) {
} else if ( (unsigned)programCounter >= vm->instructionCount ) {
Com_Error( ERR_DROP, "VM program counter out of range in OP_CALL" );
} else {
programCounter = vm->instructionPointers[ programCounter ];
@ -615,8 +615,11 @@ nextInstruction2:
*/
case OP_JUMP:
programCounter = r0;
programCounter = vm->instructionPointers[ programCounter ];
if ( (unsigned)r0 >= vm->instructionCount )
Com_Error( ERR_DROP, "VM program counter out of range in OP_JUMP" );
programCounter = vm->instructionPointers[ r0 ];
opStack--;
goto nextInstruction;

2
code/qcommon/vm_local.h
View file

@ -154,7 +154,7 @@ struct vm_s {
int codeLength;
int *instructionPointers;
int instructionPointersLength;
int instructionCount;
byte *dataBase;
int dataMask;