Merge branch 'master' of https://github.com/rheit/zdoom

bzip2/CHANGES

@@ -2,8 +2,8 @@
  This file is part of bzip2/libbzip2, a program and library for
  lossless, block-sorting data compression.
 
- bzip2/libbzip2 version 1.0.5 of 10 December 2007
+ bzip2/libbzip2 version 1.0.6 of 6 September 2010
- Copyright (C) 1996-2007 Julian Seward <jseward@bzip.org>
+ Copyright (C) 1996-2010 Julian Seward <jseward@bzip.org>
 
  Please read the WARNING, DISCLAIMER and PATENTS sections in the 
  README file.
@@ -317,3 +317,11 @@ Fixes some minor bugs since the last version, 1.0.3.
 ~~~~~~~~~~~~~~~~~
 Security fix only.  Fixes CERT-FI 20469 as it applies to bzip2.
 
+
+1.0.6 (6 Sept 10)
+~~~~~~~~~~~~~~~~~
+
+* Security fix for CVE-2010-0405.  This was reported by Mikolaj
+  Izdebski.
+
+* Make the documentation build on Ubuntu 10.04

bzip2/LICENSE

@@ -2,7 +2,7 @@
 --------------------------------------------------------------------------
 
 This program, "bzip2", the associated library "libbzip2", and all
-documentation, are copyright (C) 1996-2007 Julian R Seward.  All
+documentation, are copyright (C) 1996-2010 Julian R Seward.  All
 rights reserved.
 
 Redistribution and use in source and binary forms, with or without
@@ -37,6 +37,6 @@ NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 Julian Seward, jseward@bzip.org
-bzip2/libbzip2 version 1.0.5 of 10 December 2007
+bzip2/libbzip2 version 1.0.6 of 6 September 2010
 
 --------------------------------------------------------------------------

bzip2/README

@@ -6,8 +6,8 @@ This version is fully compatible with the previous public releases.
 This file is part of bzip2/libbzip2, a program and library for
 lossless, block-sorting data compression.
 
-bzip2/libbzip2 version 1.0.5 of 10 December 2007
+bzip2/libbzip2 version 1.0.6 of 6 September 2010
-Copyright (C) 1996-2007 Julian Seward <jseward@bzip.org>
+Copyright (C) 1996-2010 Julian Seward <jseward@bzip.org>
 
 Please read the WARNING, DISCLAIMER and PATENTS sections in this file.
 
@@ -181,6 +181,10 @@ WHAT'S NEW IN 1.0.5 ?
 
    See the CHANGES file.
 
+WHAT'S NEW IN 1.0.6 ?
+
+   See the CHANGES file.
+
 
 I hope you find bzip2 useful.  Feel free to contact me at
    jseward@bzip.org
@@ -208,3 +212,4 @@ Cambridge, UK.
 15 February 2005 (bzip2, version 1.0.3)
 20 December 2006 (bzip2, version 1.0.4)
 10 December 2007 (bzip2, version 1.0.5)
+ 6     Sept 2010 (bzip2, version 1.0.6)

bzip2/blocksort.c

@@ -8,8 +8,8 @@
    This file is part of bzip2/libbzip2, a program and library for
    lossless, block-sorting data compression.
 
-   bzip2/libbzip2 version 1.0.5 of 10 December 2007
+   bzip2/libbzip2 version 1.0.6 of 6 September 2010
-   Copyright (C) 1996-2007 Julian Seward <jseward@bzip.org>
+   Copyright (C) 1996-2010 Julian Seward <jseward@bzip.org>
 
    Please read the WARNING, DISCLAIMER and PATENTS sections in the 
    README file.

bzip2/bzlib.c

@@ -8,8 +8,8 @@
    This file is part of bzip2/libbzip2, a program and library for
    lossless, block-sorting data compression.
 
-   bzip2/libbzip2 version 1.0.5 of 10 December 2007
+   bzip2/libbzip2 version 1.0.6 of 6 September 2010
-   Copyright (C) 1996-2007 Julian Seward <jseward@bzip.org>
+   Copyright (C) 1996-2010 Julian Seward <jseward@bzip.org>
 
    Please read the WARNING, DISCLAIMER and PATENTS sections in the 
    README file.

bzip2/bzlib.h

@@ -8,8 +8,8 @@
    This file is part of bzip2/libbzip2, a program and library for
    lossless, block-sorting data compression.
 
-   bzip2/libbzip2 version 1.0.5 of 10 December 2007
+   bzip2/libbzip2 version 1.0.6 of 6 September 2010
-   Copyright (C) 1996-2007 Julian Seward <jseward@bzip.org>
+   Copyright (C) 1996-2010 Julian Seward <jseward@bzip.org>
 
    Please read the WARNING, DISCLAIMER and PATENTS sections in the 
    README file.

bzip2/bzlib_private.h

@@ -8,8 +8,8 @@
    This file is part of bzip2/libbzip2, a program and library for
    lossless, block-sorting data compression.
 
-   bzip2/libbzip2 version 1.0.5 of 10 December 2007
+   bzip2/libbzip2 version 1.0.6 of 6 September 2010
-   Copyright (C) 1996-2007 Julian Seward <jseward@bzip.org>
+   Copyright (C) 1996-2010 Julian Seward <jseward@bzip.org>
 
    Please read the WARNING, DISCLAIMER and PATENTS sections in the 
    README file.
@@ -36,7 +36,7 @@
 
 /*-- General stuff. --*/
 
-#define BZ_VERSION  "1.0.5, 10-Dec-2007"
+#define BZ_VERSION  "1.0.6, 6-Sept-2010"
 
 typedef char            Char;
 typedef unsigned char   Bool;

bzip2/compress.c

@@ -8,8 +8,8 @@
    This file is part of bzip2/libbzip2, a program and library for
    lossless, block-sorting data compression.
 
-   bzip2/libbzip2 version 1.0.5 of 10 December 2007
+   bzip2/libbzip2 version 1.0.6 of 6 September 2010
-   Copyright (C) 1996-2007 Julian Seward <jseward@bzip.org>
+   Copyright (C) 1996-2010 Julian Seward <jseward@bzip.org>
 
    Please read the WARNING, DISCLAIMER and PATENTS sections in the 
    README file.

bzip2/crctable.c

@@ -8,8 +8,8 @@
    This file is part of bzip2/libbzip2, a program and library for
    lossless, block-sorting data compression.
 
-   bzip2/libbzip2 version 1.0.5 of 10 December 2007
+   bzip2/libbzip2 version 1.0.6 of 6 September 2010
-   Copyright (C) 1996-2007 Julian Seward <jseward@bzip.org>
+   Copyright (C) 1996-2010 Julian Seward <jseward@bzip.org>
 
    Please read the WARNING, DISCLAIMER and PATENTS sections in the 
    README file.

bzip2/decompress.c

@@ -8,8 +8,8 @@
    This file is part of bzip2/libbzip2, a program and library for
    lossless, block-sorting data compression.
 
-   bzip2/libbzip2 version 1.0.5 of 10 December 2007
+   bzip2/libbzip2 version 1.0.6 of 6 September 2010
-   Copyright (C) 1996-2007 Julian Seward <jseward@bzip.org>
+   Copyright (C) 1996-2010 Julian Seward <jseward@bzip.org>
 
    Please read the WARNING, DISCLAIMER and PATENTS sections in the 
    README file.
@@ -381,6 +381,13 @@ Int32 BZ2_decompress ( DState* s )
             es = -1;
             N = 1;
             do {
+               /* Check that N doesn't get too big, so that es doesn't
+                  go negative.  The maximum value that can be
+                  RUNA/RUNB encoded is equal to the block size (post
+                  the initial RLE), viz, 900k, so bounding N at 2
+                  million should guard against overflow without
+                  rejecting any legitimate inputs. */
+               if (N >= 2*1024*1024) RETURN(BZ_DATA_ERROR);
                if (nextSym == BZ_RUNA) es = es + (0+1) * N; else
                if (nextSym == BZ_RUNB) es = es + (1+1) * N;
                N = N * 2;
@@ -485,15 +492,28 @@ Int32 BZ2_decompress ( DState* s )
          RETURN(BZ_DATA_ERROR);
 
       /*-- Set up cftab to facilitate generation of T^(-1) --*/
+      /* Check: unzftab entries in range. */
+      for (i = 0; i <= 255; i++) {
+         if (s->unzftab[i] < 0 || s->unzftab[i] > nblock)
+            RETURN(BZ_DATA_ERROR);
+      }
+      /* Actually generate cftab. */
       s->cftab[0] = 0;
       for (i = 1; i <= 256; i++) s->cftab[i] = s->unzftab[i-1];
       for (i = 1; i <= 256; i++) s->cftab[i] += s->cftab[i-1];
+      /* Check: cftab entries in range. */
       for (i = 0; i <= 256; i++) {
          if (s->cftab[i] < 0 || s->cftab[i] > nblock) {
             /* s->cftab[i] can legitimately be == nblock */
             RETURN(BZ_DATA_ERROR);
          }
       }
+      /* Check: cftab entries non-descending. */
+      for (i = 1; i <= 256; i++) {
+         if (s->cftab[i-1] > s->cftab[i]) {
+            RETURN(BZ_DATA_ERROR);
+         }
+      }
 
       s->state_out_len = 0;
       s->state_out_ch  = 0;

bzip2/huffman.c

@@ -8,8 +8,8 @@
    This file is part of bzip2/libbzip2, a program and library for
    lossless, block-sorting data compression.
 
-   bzip2/libbzip2 version 1.0.5 of 10 December 2007
+   bzip2/libbzip2 version 1.0.6 of 6 September 2010
-   Copyright (C) 1996-2007 Julian Seward <jseward@bzip.org>
+   Copyright (C) 1996-2010 Julian Seward <jseward@bzip.org>
 
    Please read the WARNING, DISCLAIMER and PATENTS sections in the 
    README file.

bzip2/randtable.c

@@ -8,8 +8,8 @@
    This file is part of bzip2/libbzip2, a program and library for
    lossless, block-sorting data compression.
 
-   bzip2/libbzip2 version 1.0.5 of 10 December 2007
+   bzip2/libbzip2 version 1.0.6 of 6 September 2010
-   Copyright (C) 1996-2007 Julian Seward <jseward@bzip.org>
+   Copyright (C) 1996-2010 Julian Seward <jseward@bzip.org>
 
    Please read the WARNING, DISCLAIMER and PATENTS sections in the 
    README file.

game-music-emu/gme/Spc_Cpu.h

@@ -76,8 +76,8 @@ Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA */
 // TODO: remove non-wrapping versions?
 #define SPC_NO_SP_WRAPAROUND 0
 
-#define SET_SP( v )     (sp = ram + 0x101 + (v))
+#define SET_SP( v )     (sp = ram + 0x101 + ((uint8_t) v))
-#define GET_SP()        (int(sp - 0x101 - ram))
+#define GET_SP()        (uint8_t) (sp - 0x101 - ram)
 
 #if SPC_NO_SP_WRAPAROUND
 #define PUSH16( v )     (sp -= 2, SET_LE16( sp, v ))
@@ -485,7 +485,7 @@ loop:
 	
 	case 0xAF: // MOV (X)+,A
 		WRITE_DP( 0, x, a + no_read_before_write  );
-		x++;
+		x = (uint8_t) (x + 1);
 		goto loop;
 	
 // 5. 8-BIT LOGIC OPERATION COMMANDS
@@ -808,7 +808,7 @@ loop:
 		unsigned temp = y * a;
 		a = (uint8_t) temp;
 		nz = ((temp >> 1) | temp) & 0x7F;
-		y = temp >> 8;
+		y = (uint8_t) (temp >> 8);
 		nz |= y;
 		goto loop;
 	}
@@ -838,6 +838,7 @@ loop:
 		
 		nz = (uint8_t) a;
 		a = (uint8_t) a;
+		y = (uint8_t) y;
 		
 		goto loop;
 	}
@@ -1004,7 +1005,7 @@ loop:
 	case 0x7F: // RET1
 		temp = *sp;
 		SET_PC( GET_LE16( sp + 1 ) );
-		sp += 3;
+		SET_SP(GET_SP() + 3);
 		goto set_psw;
 	case 0x8E: // POP PSW
 		POP( temp );

src/c_cmds.cpp

@@ -906,6 +906,16 @@ CCMD(info)
 				"the NOBLOCKMAP flag or have height/radius of 0.\n");
 }
 
+CCMD(myinfo)
+{
+	if (CheckCheatmode () || players[consoleplayer].mo == NULL) return;
+	Printf("Target=%s, Health=%d, Spawnhealth=%d\n",
+		players[consoleplayer].mo->GetClass()->TypeName.GetChars(),
+		players[consoleplayer].mo->health,
+		players[consoleplayer].mo->SpawnHealth());
+	PrintMiscActorInfo(players[consoleplayer].mo);
+}
+
 typedef bool (*ActorTypeChecker) (AActor *);
 
 static bool IsActorAMonster(AActor *mo)

src/g_inventory/a_pickups.cpp

@@ -1598,6 +1598,30 @@ CCMD (printinv)
 	}
 }
 
+CCMD (targetinv)
+{
+	AInventory *item;
+	FTranslatedLineTarget t;
+
+	if (CheckCheatmode () || players[consoleplayer].mo == NULL)
+		return;
+
+	P_AimLineAttack(players[consoleplayer].mo,players[consoleplayer].mo->Angles.Yaw, MISSILERANGE,
+		&t, 0.,	ALF_CHECKNONSHOOTABLE|ALF_FORCENOSMART);
+
+	if (t.linetarget)
+	{
+		for (item = t.linetarget->Inventory; item != NULL; item = item->Inventory)
+		{
+			Printf ("%s #%u (%d/%d)\n", item->GetClass()->TypeName.GetChars(),
+				item->InventoryID,
+				item->Amount, item->MaxAmount);
+		}
+	}
+	else Printf("No target found. Targetinv cannot find actors that have "
+				"the NOBLOCKMAP flag or have height/radius of 0.\n");
+}
+
 //===========================================================================
 //
 // AInventory :: AttachToOwner

src/p_pspr.cpp

@@ -136,6 +136,7 @@ DPSprite::DPSprite(player_t *owner, AActor *caller, int id)
 : x(.0), y(.0),
   oldx(.0), oldy(.0),
   firstTic(true),
+  Sprite(0),
   Flags(0),
   Caller(caller),
   Owner(owner),

src/p_user.cpp

@@ -1366,42 +1366,49 @@ void APlayerPawn::GiveDefaultInventory ()
 		PClassActor *ti = PClass::FindActor (di->Name);
 		if (ti)
 		{
-			AInventory *item = FindInventory (ti);
+			if (!ti->IsDescendantOf(RUNTIME_CLASS(AInventory)))
-			if (item != NULL)
 			{
-				item->Amount = clamp<int>(
+				Printf(TEXTCOLOR_ORANGE "%s is not an inventory item and cannot be given to a player as start item.\n", ti->TypeName.GetChars());
-					item->Amount + (di->Amount ? di->Amount : ((AInventory *)item->GetDefault ())->Amount),
-					0, item->MaxAmount);
 			}
 			else
 			{
-				item = static_cast<AInventory *>(Spawn (ti));
+				AInventory *item = FindInventory(ti);
-				item->ItemFlags |= IF_IGNORESKILL;	// no skill multiplicators here
+				if (item != NULL)
-				item->Amount = di->Amount;
-				if (item->IsKindOf (RUNTIME_CLASS (AWeapon)))
 				{
-					// To allow better control any weapon is emptied of
+					item->Amount = clamp<int>(
-					// ammo before being given to the player.
+						item->Amount + (di->Amount ? di->Amount : ((AInventory *)item->GetDefault())->Amount),
-					static_cast<AWeapon*>(item)->AmmoGive1 =
+						0, item->MaxAmount);
-					static_cast<AWeapon*>(item)->AmmoGive2 = 0;
 				}
-				AActor *check;
+				else
-				if (!item->CallTryPickup(this, &check))
 				{
-					if (check != this)
+					item = static_cast<AInventory *>(Spawn(ti));
+					item->ItemFlags |= IF_IGNORESKILL;	// no skill multiplicators here
+					item->Amount = di->Amount;
+					if (item->IsKindOf(RUNTIME_CLASS(AWeapon)))
 					{
-						// Player was morphed. This is illegal at game start.
+						// To allow better control any weapon is emptied of
-						// This problem is only detectable when it's too late to do something about it...
+						// ammo before being given to the player.
-						I_Error("Cannot give morph items when starting a game");
+						static_cast<AWeapon*>(item)->AmmoGive1 =
+							static_cast<AWeapon*>(item)->AmmoGive2 = 0;
+					}
+					AActor *check;
+					if (!item->CallTryPickup(this, &check))
+					{
+						if (check != this)
+						{
+							// Player was morphed. This is illegal at game start.
+							// This problem is only detectable when it's too late to do something about it...
+							I_Error("Cannot give morph items when starting a game");
+						}
+						item->Destroy();
+						item = NULL;
 					}
-					item->Destroy ();
-					item = NULL;
 				}
-			}
+				if (item != NULL && item->IsKindOf(RUNTIME_CLASS(AWeapon)) &&
-			if (item != NULL && item->IsKindOf (RUNTIME_CLASS (AWeapon)) &&
+					static_cast<AWeapon*>(item)->CheckAmmo(AWeapon::EitherFire, false))
-				static_cast<AWeapon*>(item)->CheckAmmo(AWeapon::EitherFire, false))
+				{
-			{
+					player->ReadyWeapon = player->PendingWeapon = static_cast<AWeapon *> (item);
-				player->ReadyWeapon = player->PendingWeapon = static_cast<AWeapon *> (item);
+				}
 			}
 		}
 		di = di->Next;

src/r_draw.cpp

@@ -175,6 +175,7 @@ namespace swrenderer
 		{
 			identitymap[i] = i;
 		}
+		identitycolormap.Maps = identitymap;
 	}
 
 	void R_InitFuzzTable(int fuzzoff)

src/rapidjson/writer.h

@@ -524,8 +524,13 @@ template<>
 inline bool Writer<StringBuffer>::WriteDouble(double d) {
     if (internal::Double(d).IsNanOrInf()) {
         // Note: This code path can only be reached if (RAPIDJSON_WRITE_DEFAULT_FLAGS & kWriteNanAndInfFlag).
-        if (!(kWriteDefaultFlags & kWriteNanAndInfFlag))
+		if (!(kWriteDefaultFlags & kWriteNanAndInfFlag))
-            return false;
+		{
+			// At least ensure that the output does not get broken.
+			PutReserve(*os_, 1);
+			PutUnsafe(*os_, '0');
+			return false;
+		}
         if (internal::Double(d).IsNan()) {
             PutReserve(*os_, 3);
             PutUnsafe(*os_, 'N'); PutUnsafe(*os_, 'a'); PutUnsafe(*os_, 'N');

src/scripting/codegeneration/codegen.cpp

@@ -7083,7 +7083,7 @@ FxExpression *FxFunctionCall::Resolve(FCompileContext& ctx)
 			delete this;
 			return nullptr;
 		}
-		FxExpression *self = (ctx.Function && ctx.Function->Variants[0].Flags & VARF_Method) ? new FxSelf(ScriptPosition) : nullptr;
+		FxExpression *self = (ctx.Function && (ctx.Function->Variants[0].Flags & VARF_Method) && ctx.Class->IsKindOf(RUNTIME_CLASS(PClassActor))) ? new FxSelf(ScriptPosition) : (FxExpression*)new FxConstant(ScriptPosition);
 		FxExpression *x = new FxActionSpecialCall(self, special, ArgList, ScriptPosition);
 		delete this;
 		return x->Resolve(ctx);
@@ -7655,9 +7655,9 @@ ExpEmit FxActionSpecialCall::Emit(VMFunctionBuilder *build)
 	unsigned i = 0;
 
 	build->Emit(OP_PARAMI, abs(Special));			// pass special number
-	// fixme: This really should use the Self pointer that got passed to this class instead of just using the first argument from the function. 
+
-	// Once static functions are possible, or specials can be called through a member access operator this won't work anymore.
+	ExpEmit selfemit(Self->Emit(build));
-	build->Emit(OP_PARAM, 0, REGT_POINTER, 0);		// pass self 
+	build->Emit(OP_PARAM, 0, selfemit.Konst ? REGT_POINTER | REGT_KONST : REGT_POINTER, selfemit.RegNum);			// pass special number
 	for (; i < ArgList.Size(); ++i)
 	{
 		FxExpression *argex = ArgList[i];

src/win32/i_system.cpp

@@ -1428,6 +1428,7 @@ static HCURSOR CreateAlphaCursor(FTexture *cursorpic)
 	{
 		TArray<uint32_t> unscaled;
 		unscaled.Resize(32 * 32);
+		for (int i = 0; i < 32 * 32; i++) unscaled[i] = 0;
 		FBitmap bmp((BYTE *)&unscaled[0] + 31 * 32 * 4, -32 * 4, 32, 32);
 		cursorpic->CopyTrueColorPixels(&bmp, 0, 0);
 		uint32_t *scaled = (uint32_t*)bits;

wadsrc/static/zscript/strife/strifefunctions.txt

@@ -164,7 +164,7 @@ extend class Actor
 		{
 			target = self;
 		}
-		else if (target != null && (self.target.player != null || (Flags & AMF_TARGETNONPLAYER)))
+		else if (self.target != null && (self.target.player != null || (Flags & AMF_TARGETNONPLAYER)))
 		{
 			target = self.target;
 		}