From ab9eadaac8b34c437f815ade3aebc1c710db9318 Mon Sep 17 00:00:00 2001 From: tyabus Date: Sat, 31 Aug 2024 07:10:49 +0500 Subject: [PATCH] Fixed out of bounds read with predef_flexcontroller_names array --- mp/src/game/server/baseflex.cpp | 2 +- mp/src/game/server/genericactor.cpp | 2 +- sp/src/game/server/baseflex.cpp | 2 +- sp/src/game/server/genericactor.cpp | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/mp/src/game/server/baseflex.cpp b/mp/src/game/server/baseflex.cpp index b760ed54..735077b7 100644 --- a/mp/src/game/server/baseflex.cpp +++ b/mp/src/game/server/baseflex.cpp @@ -2485,7 +2485,7 @@ void CFlexCycler::Think( void ) m_flextarget[m_flexnum] = 0; } - for (i = 0; i < 35 && predef_flexcontroller_names[i]; i++) + for (i = 0; i < 31 && predef_flexcontroller_names[i]; i++) { m_flexnum = LookupFlex( predef_flexcontroller_names[i] ); m_flextarget[m_flexnum] = predef_flexcontroller_values[j][i]; diff --git a/mp/src/game/server/genericactor.cpp b/mp/src/game/server/genericactor.cpp index dd518a4e..d1edeaa3 100644 --- a/mp/src/game/server/genericactor.cpp +++ b/mp/src/game/server/genericactor.cpp @@ -321,7 +321,7 @@ void CFlextalkActor::ProcessSceneEvents( void ) m_flextarget[m_flexnum] = 0; } - for (i = 0; i < 35 && predef_flexcontroller_names[i]; i++) + for (i = 0; i < 31 && predef_flexcontroller_names[i]; i++) { m_flexnum = LookupFlex( predef_flexcontroller_names[i] ); m_flextarget[m_flexnum] = predef_flexcontroller_values[j][i]; diff --git a/sp/src/game/server/baseflex.cpp b/sp/src/game/server/baseflex.cpp index 4e6b4629..1aafdd3d 100644 --- a/sp/src/game/server/baseflex.cpp +++ b/sp/src/game/server/baseflex.cpp @@ -2485,7 +2485,7 @@ void CFlexCycler::Think( void ) m_flextarget[m_flexnum] = 0; } - for (i = 0; i < 35 && predef_flexcontroller_names[i]; i++) + for (i = 0; i < 31 && predef_flexcontroller_names[i]; i++) { m_flexnum = LookupFlex( predef_flexcontroller_names[i] ); m_flextarget[m_flexnum] = predef_flexcontroller_values[j][i]; diff --git a/sp/src/game/server/genericactor.cpp b/sp/src/game/server/genericactor.cpp index 6f104887..269c2c33 100644 --- a/sp/src/game/server/genericactor.cpp +++ b/sp/src/game/server/genericactor.cpp @@ -321,7 +321,7 @@ void CFlextalkActor::ProcessSceneEvents( void ) m_flextarget[m_flexnum] = 0; } - for (i = 0; i < 35 && predef_flexcontroller_names[i]; i++) + for (i = 0; i < 31 && predef_flexcontroller_names[i]; i++) { m_flexnum = LookupFlex( predef_flexcontroller_names[i] ); m_flextarget[m_flexnum] = predef_flexcontroller_values[j][i];