zdoom/raze
0
0
Fork 0
mirror of https://github.com/ZDoom/Raze.git synced 2025-01-18 14:41:55 +00:00
Code Issues Projects Releases Packages Wiki Activity

In G_SaveMapState, fix 1024-byte write beyond array bound on 64-bit platforms.

Browse source 
This was caused by mismatched for types mapstate_t's animateptr[] and the global
one (int32_t vs. int32_t *).

Bump BYTEVERSION.

git-svn-id: https://svn.eduke32.com/eduke32@4125 1a8010ca-5511-0410-912e-c29ae57300e0
This commit is contained in:
helixhorned 2013-10-28 21:26:32 +00:00
parent 8beb990640
commit b6475100d7
3 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
polymer/eduke32/source/duke3d.h
View file

@ -62,7 +62,7 @@ Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
# define BYTEVERSION_JF 288
#else
// Non-Lua build
# define BYTEVERSION_JF 285
# define BYTEVERSION_JF 288
#endif
#define BYTEVERSION_13 27

4
polymer/eduke32/source/gameexec.c
View file

@ -5535,6 +5535,10 @@ void G_SaveMapState(void)
Bmemcpy(&save->animateptr[0],&animateptr[0],sizeof(animateptr));
G_Util_PtrToIdx(animateptr, g_animateCount, sector, P2I_BACK);
{
EDUKE32_STATIC_ASSERT(sizeof(save->animateptr) == sizeof(animateptr));
}
Bmemcpy(&save->g_numPlayerSprites,&g_numPlayerSprites,sizeof(g_numPlayerSprites));
Bmemcpy(&save->g_earthquakeTime,&g_earthquakeTime,sizeof(g_earthquakeTime));
Bmemcpy(&save->lockclock,&lockclock,sizeof(lockclock));

2
polymer/eduke32/source/sector.h
View file

@ -40,7 +40,7 @@ typedef struct {
// this needs to have a copy of everything related to the map/actor state
// see savegame.c
int32_t animategoal[MAXANIMATES], animatevel[MAXANIMATES], g_animateCount;
int32_t animateptr[MAXANIMATES];
intptr_t animateptr[MAXANIMATES];
int32_t lockclock;
int32_t msx[2048], msy[2048];
int32_t randomseed, g_globalRandom;