zdoom/raze-gles
0
0
Fork 0
mirror of https://github.com/ZDoom/raze-gles.git synced 2024-11-11 07:11:39 +00:00
Code Issues Projects Releases Packages Wiki Activity

game.c: remove dead bounds check for cheatbuf[], add assertion.

Browse source 
The check is dead because it is made after the fact (oob access), but the
cheat string matching logic below actually assures that
cheatbuflen < sizeof(cheatbuf) at all times.
Exposed using the Stack tool from http://css.csail.mit.edu/stack/ .
Also, in gamedef.c's definecheat handling, print the string length (19), not
the buffer length (20) if the cheat was truncated.

git-svn-id: https://svn.eduke32.com/eduke32@4016 1a8010ca-5511-0410-912e-c29ae57300e0
This commit is contained in:
helixhorned 2013-08-12 15:18:20 +00:00
parent 7a9e9fada4
commit 171226c7ac
2 changed files with 6 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
polymer/eduke32/source/game.c
View file

@ -7973,7 +7973,8 @@ static void end_cheat(void)
KB_FlushKeyboardQueue();
}
static int8_t cheatbuf[MAXCHEATLEN], cheatbuflen;
static int32_t cheatbuflen;
static int8_t cheatbuf[MAXCHEATLEN];
GAME_STATIC void G_DoCheats(void)
{
@ -8016,15 +8017,12 @@ GAME_STATIC void G_DoCheats(void)
}
cheatbuf[cheatbuflen++] = (int8_t)ch;
// This assertion is not obvious, but it should hold because of the
// cheat string matching logic below.
Bassert(cheatbuflen < (signed)sizeof(cheatbuf));
cheatbuf[cheatbuflen] = 0;
// KB_ClearKeysDown();
if (cheatbuflen > MAXCHEATLEN)
{
g_player[myconnectindex].ps->cheat_phase = 0;
return;
}
for (k=0; k < NUMCHEATCODES; k++)
{
for (j = 0; j<cheatbuflen; j++)

2
polymer/eduke32/source/gamedef.c
View file

@ -5828,7 +5828,7 @@ repeatcase:
if (i >= (signed)sizeof(CheatStrings[k])-1)
{
initprintf("%s:%d: warning: truncating cheat string to %d characters.\n",
g_szScriptFileName,g_lineNumber,MAXCHEATLEN); //,sizeof(CheatStrings[k])-1);
g_szScriptFileName,g_lineNumber,(signed)sizeof(CheatStrings[k])-1);
g_numCompilerWarnings++;
C_NextLine();
break;