Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Pathfinder: Fix out-of-bounds read/write at load/store of games #611

Merged
merged 3 commits into from
Feb 26, 2024

Commits on Feb 25, 2024

  1. Fix typo: PathRacalculated

    zzam committed Feb 25, 2024
    Configuration menu
    Copy the full SHA
    737be8f View commit details
    Browse the repository at this point in the history

Commits on Feb 26, 2024

  1. Pathfinder: only load and store paths with good length

    This avoids buffer overruns on loading and saving of games.
    This should fix some crashes.
    
    See Wargus#610
    
    It fixes e.g. this valgrind warning (at loading):
    
    ==24878== Invalid write of size 1
    ==24878==    at 0x3DBC63: PathFinderOutput::Load(lua_State*) (script_unit.cpp:261)
    ==24878==    by 0x3DD5D5: CclUnit(lua_State*) (script_unit.cpp:500)
    ==24878==    by 0x48A9F4D: luaD_precall (ldo.c:320)
    ==24878==    by 0x48BBBB3: luaV_execute (lvm.c:591)
    ==24878==    by 0x48AA5FC: luaD_call (ldo.c:378)
    ==24878==    by 0x48A98EA: luaD_rawrunprotected (ldo.c:116)
    ==24878==    by 0x48AA79C: luaD_pcall (ldo.c:464)
    ==24878==    by 0x48A1E67: lua_pcall (lapi.c:821)
    ==24878==    by 0x390DDB: LuaCall(lua_State*, int, int, int, bool) (script.cpp:200)
    ==24878==    by 0x390D69: LuaCall(int, int, bool) (script.cpp:172)
    ==24878==    by 0x3914BB: LuaLoadFile(std::filesystem::__cxx11::path const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool) (script.cpp:271)
    ==24878==    by 0x2B1946: LoadGame(std::filesystem::__cxx11::path const&) (loadgame.cpp:204)
    ==24878==  Address 0x10819890 is 0 bytes after a block of size 64 alloc'd
    ==24878==    at 0x483EEDD: operator new(unsigned long) (vg_replace_malloc.c:485)
    ==24878==    by 0x1D528D: std::__detail::_MakeUniq<PathFinderData>::__single_object std::make_unique<PathFinderData>() (unique_ptr.h:1070)
    ==24878==    by 0x1CAC05: CUnit::Init() (unit.cpp:425)
    ==24878==    by 0x1EA254: CUnit::CUnit() (unit.h:142)
    ==24878==    by 0x1E9AEE: CUnitManager::Load(lua_State*) (unit_manager.cpp:180)
    ==24878==    by 0x3E287A: CclSlotUsage(lua_State*) (script_unit.cpp:1486)
    ==24878==    by 0x48A9F4D: luaD_precall (ldo.c:320)
    ==24878==    by 0x48BBBB3: luaV_execute (lvm.c:591)
    ==24878==    by 0x48AA5FC: luaD_call (ldo.c:378)
    ==24878==    by 0x48A98EA: luaD_rawrunprotected (ldo.c:116)
    ==24878==    by 0x48AA79C: luaD_pcall (ldo.c:464)
    ==24878==    by 0x48A1E67: lua_pcall (lapi.c:821)
    zzam committed Feb 26, 2024
    Configuration menu
    Copy the full SHA
    6565d2d View commit details
    Browse the repository at this point in the history
  2. Configuration menu
    Copy the full SHA
    a214447 View commit details
    Browse the repository at this point in the history