zdoom/gzdoom
0
0
Fork 0
mirror of https://github.com/ZDoom/gzdoom.git synced 2025-02-17 01:31:25 +00:00
Code Issues Projects Releases Packages Wiki Activity

- hardened the seg integrity checks against extremely broken mods.

Browse source 
Temple of the Lizardmen 3 has segs lumps in every level that seem to use a different data format and are completely unusable, up to triggering undefined behavior.
This commit is contained in:
Christoph Oelckers 2018-12-03 18:10:36 +01:00
parent 1b07bded47
commit 6faeadaceb
1 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
src/p_setup.cpp
View file

@ -1176,12 +1176,12 @@ template<class segtype>
void P_LoadSegs (MapData * map) void P_LoadSegs (MapData * map)
{ {
uint8_t *data; uint8_t *data;
int numvertexes = level.vertexes.Size(); uint32_t numvertexes = level.vertexes.Size();
uint8_t *vertchanged = new uint8_t[numvertexes]; // phares 10/4/98 uint8_t *vertchanged = new uint8_t[numvertexes]; // phares 10/4/98
uint32_t segangle; uint32_t segangle;
//int ptp_angle; // phares 10/4/98 //int ptp_angle; // phares 10/4/98
//int delta_angle; // phares 10/4/98 //int delta_angle; // phares 10/4/98
int vnum1,vnum2; // phares 10/4/98 uint32_t vnum1,vnum2; // phares 10/4/98
int lumplen = map->Size(ML_SEGS); int lumplen = map->Size(ML_SEGS);
memset (vertchanged,0,numvertexes); // phares 10/4/98 memset (vertchanged,0,numvertexes); // phares 10/4/98
@ -1300,6 +1300,10 @@ void P_LoadSegs (MapData * map)
ldef = &level.lines[linedef]; ldef = &level.lines[linedef];
li->linedef = ldef; li->linedef = ldef;
side = LittleShort(ml->side); side = LittleShort(ml->side);
if (side != 0 && side != 1)
{
throw badseg(3, i, side);
}
if ((unsigned)(ldef->sidedef[side]->Index()) >= level.sides.Size()) if ((unsigned)(ldef->sidedef[side]->Index()) >= level.sides.Size())
{ {
throw badseg(2, i, ldef->sidedef[side]->Index()); throw badseg(2, i, ldef->sidedef[side]->Index());
@ -1334,6 +1338,10 @@ void P_LoadSegs (MapData * map)
case 2: case 2:
Printf ("The linedef for seg %d references a nonexistant sidedef %d (max %d).\n", bad.badsegnum, bad.baddata, level.sides.Size()); Printf ("The linedef for seg %d references a nonexistant sidedef %d (max %d).\n", bad.badsegnum, bad.baddata, level.sides.Size());
break; break;
case 3:
Printf("Sidedef reference in seg %d is %d (must be 0 or 1).\n", bad.badsegnum, bad.baddata);
break;
} }
Printf ("The BSP will be rebuilt.\n"); Printf ("The BSP will be rebuilt.\n");
level.segs.Clear(); level.segs.Clear();