From 18839acddbe4686e992bba761621b40548a92581 Mon Sep 17 00:00:00 2001
From: Christoph Oelckers <coelckers@zdoom.fake>
Date: Sat, 9 Jun 2012 11:05:25 +0000
Subject: [PATCH] - added a check to the MENUDEF parser to prevent special
 menus from being replaced by something non-functional to counter attempts to
 cripple the engine's functionality.

SVN r3682 (trunk)
---
 src/menu/menu.h      |  3 +--
 src/menu/menudef.cpp | 44 +++++++++++++++++++++++++++++++++++---------
 2 files changed, 36 insertions(+), 11 deletions(-)

diff --git a/src/menu/menu.h b/src/menu/menu.h
index f9611433c8..a8ec2989b5 100644
--- a/src/menu/menu.h
+++ b/src/menu/menu.h
@@ -86,6 +86,7 @@ struct FMenuDescriptor
 	FName mMenuName;
 	FString mNetgameMessage;
 	int mType;
+	const PClass *mClass;
 
 	virtual ~FMenuDescriptor() {}
 };
@@ -108,7 +109,6 @@ struct FListMenuDescriptor : public FMenuDescriptor
 	FFont *mFont;
 	EColorRange mFontColor;
 	EColorRange mFontColor2;
-	const PClass *mClass;
 	FMenuDescriptor *mRedirect;	// used to redirect overlong skill and episode menus to option menu based alternatives
 	bool mCenter;
 
@@ -153,7 +153,6 @@ struct FOptionMenuDescriptor : public FMenuDescriptor
 	int mIndent;
 	int mPosition;
 	bool mDontDim;
-	const PClass *mClass;
 
 	void CalcIndent();
 	FOptionMenuItem *GetItem(FName name);
diff --git a/src/menu/menudef.cpp b/src/menu/menudef.cpp
index 57d7751f75..349f08bf36 100644
--- a/src/menu/menudef.cpp
+++ b/src/menu/menudef.cpp
@@ -450,6 +450,37 @@ static void ParseListMenuBody(FScanner &sc, FListMenuDescriptor *desc)
 //
 //=============================================================================
 
+static bool CheckCompatible(FMenuDescriptor *newd, FMenuDescriptor *oldd)
+{
+	if (oldd->mClass == NULL) return true;
+	return oldd->mClass == newd->mClass;
+}
+
+static bool ReplaceMenu(FScanner &sc, FMenuDescriptor *desc)
+{
+	FMenuDescriptor **pOld = MenuDescriptors.CheckKey(desc->mMenuName);
+	if (pOld != NULL && *pOld != NULL) 
+	{
+		if (CheckCompatible(desc, *pOld))
+		{
+			delete *pOld;
+		}
+		else
+		{
+			sc.ScriptMessage("Tried to replace menu '%s' with a menu of different type", desc->mMenuName.GetChars());
+			return true;
+		}
+	}
+	MenuDescriptors[desc->mMenuName] = desc;
+	return false;
+}
+
+//=============================================================================
+//
+//
+//
+//=============================================================================
+
 static void ParseListMenu(FScanner &sc)
 {
 	sc.MustGetString();
@@ -476,11 +507,9 @@ static void ParseListMenu(FScanner &sc)
 	desc->mWRight = 0;
 	desc->mCenter = false;
 
-	FMenuDescriptor **pOld = MenuDescriptors.CheckKey(desc->mMenuName);
-	if (pOld != NULL && *pOld != NULL) delete *pOld;
-	MenuDescriptors[desc->mMenuName] = desc;
-
 	ParseListMenuBody(sc, desc);
+	bool scratch = ReplaceMenu(sc, desc);
+	if (scratch) delete desc;
 }
 
 //=============================================================================
@@ -810,13 +839,10 @@ static void ParseOptionMenu(FScanner &sc)
 	desc->mIndent =  DefaultOptionMenuSettings.mIndent;
 	desc->mDontDim =  DefaultOptionMenuSettings.mDontDim;
 
-	FMenuDescriptor **pOld = MenuDescriptors.CheckKey(desc->mMenuName);
-	if (pOld != NULL && *pOld != NULL) delete *pOld;
-	MenuDescriptors[desc->mMenuName] = desc;
-
 	ParseOptionMenuBody(sc, desc);
-
+	bool scratch = ReplaceMenu(sc, desc);
 	if (desc->mIndent == 0) desc->CalcIndent();
+	if (scratch) delete desc;
 }