zdoom/raze-gles
0
0
Fork 0
mirror of https://github.com/ZDoom/raze-gles.git synced 2025-01-11 18:50:46 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fix a number of oob accesses with "switch switches".

Browse source 
Various code checked for switch tiles in the following manner,
  for (ii=0; ii<2; ii++)
      switch (DynamicTileMap[sprite[i].picnum-1+ii]) { case SOME_SWITCH: ... }
which blows for picnum 0.  Now, we simply disallow it.

git-svn-id: https://svn.eduke32.com/eduke32@2174 1a8010ca-5511-0410-912e-c29ae57300e0
This commit is contained in:
helixhorned 2011-12-11 13:26:39 +00:00
parent 44d002c354
commit ba858b3858
3 changed files with 19 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
polymer/eduke32/source/actors.c
View file

@ -8045,6 +8045,10 @@ inline int32_t A_CheckEnemySprite(spritetype *s)
int32_t A_CheckSwitchTile(int32_t i) int32_t A_CheckSwitchTile(int32_t i)
{ {
int32_t j; int32_t j;
if (PN <= 0) // picnum 0 would oob in the switch below
return 0;
//MULTISWITCH has 4 states so deal with it separately //MULTISWITCH has 4 states so deal with it separately
if ((PN >= MULTISWITCH) && (PN <=MULTISWITCH+3)) return 1; if ((PN >= MULTISWITCH) && (PN <=MULTISWITCH+3)) return 1;
// ACCESSSWITCH and ACCESSSWITCH2 are only active in 1 state so deal with them separately // ACCESSSWITCH and ACCESSSWITCH2 are only active in 1 state so deal with them separately
@ -8152,6 +8156,10 @@ void G_MoveWorld(void)
} }
for (ii=0; ii<2; ii++) for (ii=0; ii<2; ii++)
{
if (sprite[i].picnum <= 0) // oob safety
break;
switch (DynamicTileMap[sprite[i].picnum-1+ii]) switch (DynamicTileMap[sprite[i].picnum-1+ii])
{ {
case DIPSWITCH__STATIC: case DIPSWITCH__STATIC:
@ -8212,6 +8220,7 @@ void G_MoveWorld(void)
} }
break; break;
} }
}
switch (DynamicTileMap[sprite[i].picnum]) switch (DynamicTileMap[sprite[i].picnum])
{ {

3
polymer/eduke32/source/premap.c
View file

@ -1236,6 +1236,9 @@ static inline void prelevel(char g)
int32_t dx, dy; int32_t dx, dy;
int16_t sprsec; int16_t sprsec;
#endif #endif
if (PN <= 0) // oob safety for switch below
continue;
for (ii=0; ii<2; ii++) for (ii=0; ii<2; ii++)
switch (DynamicTileMap[PN-1+ii]) switch (DynamicTileMap[PN-1+ii])
{ {

11
polymer/eduke32/source/sector.c
View file

@ -1293,7 +1293,6 @@ int32_t P_ActivateSwitch(int32_t snum,int32_t w,int32_t switchtype)
} }
switch (DynamicTileMap[switchpicnum]) switch (DynamicTileMap[switchpicnum])
{ {
case DIPSWITCH__STATIC: case DIPSWITCH__STATIC:
case TECHSWITCH__STATIC: case TECHSWITCH__STATIC:
case ALIENSWITCH__STATIC: case ALIENSWITCH__STATIC:
@ -1319,9 +1318,11 @@ int32_t P_ActivateSwitch(int32_t snum,int32_t w,int32_t switchtype)
sprite[i].picnum++; sprite[i].picnum++;
break; break;
default: default:
if (switchpicnum <= 0) // oob safety
break;
switch (DynamicTileMap[switchpicnum-1]) switch (DynamicTileMap[switchpicnum-1])
{ {
case TECHSWITCH__STATIC: case TECHSWITCH__STATIC:
case DIPSWITCH__STATIC: case DIPSWITCH__STATIC:
case ALIENSWITCH__STATIC: case ALIENSWITCH__STATIC:
@ -1363,9 +1364,9 @@ int32_t P_ActivateSwitch(int32_t snum,int32_t w,int32_t switchtype)
wall[x].picnum = MULTISWITCH; wall[x].picnum = MULTISWITCH;
} }
switch (DynamicTileMap[wall[x].picnum]) switch (DynamicTileMap[wall[x].picnum])
{ {
case DIPSWITCH__STATIC: case DIPSWITCH__STATIC:
case TECHSWITCH__STATIC: case TECHSWITCH__STATIC:
case ALIENSWITCH__STATIC: case ALIENSWITCH__STATIC:
@ -1391,9 +1392,11 @@ int32_t P_ActivateSwitch(int32_t snum,int32_t w,int32_t switchtype)
wall[x].picnum++; wall[x].picnum++;
break; break;
default: default:
if (wall[x].picnum <= 0) // oob safety
break;
switch (DynamicTileMap[wall[x].picnum-1]) switch (DynamicTileMap[wall[x].picnum-1])
{ {
case TECHSWITCH__STATIC: case TECHSWITCH__STATIC:
case DIPSWITCH__STATIC: case DIPSWITCH__STATIC:
case ALIENSWITCH__STATIC: case ALIENSWITCH__STATIC: