yquake2
/
yquake2remaster
mirror of https://github.com/yquake2/yquake2remaster.git
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Include guard pointers 

Spincontrol checks for null itemnames, which could cause undefined behaviour (menu disappears or crashes) in some instances.
This commit is contained in:
apartfromtime 2022-09-10 09:05:36 +10:00
parent 45f4e1860c
commit f63b5914f6
1 changed files with 14 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
src/client/menu/menu.c
View File

@ -5228,7 +5228,6 @@ PlayerDirectoryList(void)
char* findname = "players/*";
char** list = 0;
int num = 0;
int n = 0;
// get a list of "players" subdirectories
if ((list = FS_ListFiles2(findname, &num, 0, 0)) == 0)
@ -5236,35 +5235,20 @@ PlayerDirectoryList(void)
return false;
}
n = num;
if (n > MAX_PLAYERMODELS)
if (num > MAX_PLAYERMODELS)
{
n = MAX_PLAYERMODELS - 1;
}
s_directory.num = 0;
for (int i = 0; i < n; ++i)
{
// last element of FS_FileList maybe null
if (list[i] == 0)
{
break;
}
s_directory.num++;
num = MAX_PLAYERMODELS - 1;
}
// malloc directories
char** data = (char**)malloc(s_directory.num * sizeof(char*));
YQ2_COM_CHECK_OOM(data, "malloc()", s_directory.num * sizeof(char*))
memset(data, 0, s_directory.num * sizeof(char*));
char** data = (char**)malloc(num * sizeof(char*));
YQ2_COM_CHECK_OOM(data, "malloc()", num * sizeof(char*))
memset(data, 0, num * sizeof(char*));
s_directory.data = data;
s_directory.num = 0;
s_directory.num = num;
for (int i = 0; i < n; ++i)
for (int i = 0; i < num; ++i)
{
// last element of FS_FileList maybe null
if (list[i] == 0)
@ -5282,14 +5266,14 @@ PlayerDirectoryList(void)
strncpy(s, t, MAX_QPATH - 1); // MAX_QPATH - 1, gcc warns about truncation
s[strlen(s)] = 0;
data[s_directory.num++] = s;
data[i] = s;
}
// free file list
FS_FreeList(list, num);
// sort them male, female, alphabetical
qsort(s_directory.data, s_directory.num, sizeof(char**), dircmp_func);
qsort(s_directory.data, s_directory.num - 1, sizeof(char**), dircmp_func);
return true;
}
@ -5369,9 +5353,9 @@ PlayerModelList(void)
}
// malloc skinnames
data = (char**)malloc(s_skinnames[mdl].num * sizeof(char*));
YQ2_COM_CHECK_OOM(data, "malloc()", s_skinnames[mdl].num * sizeof(char*))
memset(data, 0, s_skinnames[mdl].num * sizeof(char*));
data = (char**)malloc((s_skinnames[mdl].num + 1) * sizeof(char*));
YQ2_COM_CHECK_OOM(data, "malloc()", (s_skinnames[mdl].num + 1) * sizeof(char*))
memset(data, 0, (s_skinnames[mdl].num + 1) * sizeof(char*));
s_skinnames[mdl].data = data;
s_skinnames[mdl].num = 0;
@ -5406,6 +5390,8 @@ PlayerModelList(void)
}
}
s_skinnames[mdl].num++; // guard pointer
// at this point we have a valid player model
s = (char*)malloc(MAX_DISPLAYNAME);
t = strrchr(s_directory.data[i], '/');