zdoom/raze-gles
0
0
Fork 0
mirror of https://github.com/ZDoom/raze-gles.git synced 2025-01-11 18:50:46 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fix a number of oob accesses with "switch switches".

Browse source 
Various code checked for switch tiles in the following manner,
  for (ii=0; ii<2; ii++)
      switch (DynamicTileMap[sprite[i].picnum-1+ii]) { case SOME_SWITCH: ... }
which blows for picnum 0.  Now, we simply disallow it.

git-svn-id: https://svn.eduke32.com/eduke32@2174 1a8010ca-5511-0410-912e-c29ae57300e0
This commit is contained in:
helixhorned 2011-12-11 13:26:39 +00:00
parent 44d002c354
commit ba858b3858
3 changed files with 19 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
polymer/eduke32/source/actors.c
View file

@ -8045,6 +8045,10 @@ inline int32_t A_CheckEnemySprite(spritetype *s)
int32_t A_CheckSwitchTile(int32_t i)
{
int32_t j;
if (PN <= 0) // picnum 0 would oob in the switch below
return 0;
//MULTISWITCH has 4 states so deal with it separately
if ((PN >= MULTISWITCH) && (PN <=MULTISWITCH+3)) return 1;
// ACCESSSWITCH and ACCESSSWITCH2 are only active in 1 state so deal with them separately
@ -8152,6 +8156,10 @@ void G_MoveWorld(void)
}
for (ii=0; ii<2; ii++)
{
if (sprite[i].picnum <= 0) // oob safety
break;
switch (DynamicTileMap[sprite[i].picnum-1+ii])
{
case DIPSWITCH__STATIC:
@ -8212,6 +8220,7 @@ void G_MoveWorld(void)
}
break;
}
}
switch (DynamicTileMap[sprite[i].picnum])
{

3
polymer/eduke32/source/premap.c
View file

@ -1236,6 +1236,9 @@ static inline void prelevel(char g)
int32_t dx, dy;
int16_t sprsec;
#endif
if (PN <= 0) // oob safety for switch below
continue;
for (ii=0; ii<2; ii++)
switch (DynamicTileMap[PN-1+ii])
{

11
polymer/eduke32/source/sector.c
View file

@ -1293,7 +1293,6 @@ int32_t P_ActivateSwitch(int32_t snum,int32_t w,int32_t switchtype)
}
switch (DynamicTileMap[switchpicnum])
{
case DIPSWITCH__STATIC:
case TECHSWITCH__STATIC:
case ALIENSWITCH__STATIC:
@ -1319,9 +1318,11 @@ int32_t P_ActivateSwitch(int32_t snum,int32_t w,int32_t switchtype)
sprite[i].picnum++;
break;
default:
if (switchpicnum <= 0) // oob safety
break;
switch (DynamicTileMap[switchpicnum-1])
{
case TECHSWITCH__STATIC:
case DIPSWITCH__STATIC:
case ALIENSWITCH__STATIC:
@ -1363,9 +1364,9 @@ int32_t P_ActivateSwitch(int32_t snum,int32_t w,int32_t switchtype)
wall[x].picnum = MULTISWITCH;
}
switch (DynamicTileMap[wall[x].picnum])
{
case DIPSWITCH__STATIC:
case TECHSWITCH__STATIC:
case ALIENSWITCH__STATIC:
@ -1391,9 +1392,11 @@ int32_t P_ActivateSwitch(int32_t snum,int32_t w,int32_t switchtype)
wall[x].picnum++;
break;
default:
if (wall[x].picnum <= 0) // oob safety
break;
switch (DynamicTileMap[wall[x].picnum-1])
{
case TECHSWITCH__STATIC:
case DIPSWITCH__STATIC:
case ALIENSWITCH__STATIC: