zdoom/raze-gles
0
0
Fork 0
mirror of https://github.com/ZDoom/raze-gles.git synced 2024-12-26 03:30:46 +00:00
Code Issues Projects Releases Packages Wiki Activity

Guard a sprite/actor access with sector[].hitag as index from OOB.

Browse source 
Unlikely but possible for rogue CON code.

git-svn-id: https://svn.eduke32.com/eduke32@4185 1a8010ca-5511-0410-912e-c29ae57300e0
This commit is contained in:
helixhorned 2013-12-01 18:27:52 +00:00
parent ce68b4ab0f
commit 67c1157b64
2 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
polymer/eduke32/source/game.c
View file

@ -6737,6 +6737,7 @@ int32_t A_Spawn(int32_t j, int32_t pn)
sp->extra = 0; sp->extra = 0;
else sp->extra = 1; else sp->extra = 1;
// TRAIN_SECTOR_TO_SE_INDEX
sector[sect].hitag = i; sector[sect].hitag = i;
j = 0; j = 0;

8
polymer/eduke32/source/player.c
View file

@ -5100,12 +5100,14 @@ HORIZONLY:
// ST_2_UNDERWATER // ST_2_UNDERWATER
if (p->cursectnum >= 0 && psectlotag < 3) if (p->cursectnum >= 0 && psectlotag < 3)
{ {
const sectortype *sec = &sector[p->cursectnum];
// p->cursectnum = s->sectnum; // p->cursectnum = s->sectnum;
if (!ud.noclip && sector[p->cursectnum].lotag == ST_31_TWO_WAY_TRAIN) if (!ud.noclip && sec->lotag == ST_31_TWO_WAY_TRAIN)
{ {
// XXX: POTENTIAL_OOB // TRAIN_SECTOR_TO_SE_INDEX
if (sprite[sector[p->cursectnum].hitag].xvel && actor[sector[p->cursectnum].hitag].t_data[0] == 0) if ((unsigned)sec->hitag < MAXSPRITES && sprite[sec->hitag].xvel
&& actor[sec->hitag].t_data[0] == 0)
{ {
P_QuickKill(p); P_QuickKill(p);
return; return;