doom/strife: Fix possible UB in function P_SpawnMapThing when executi…

…ng left shift with negative gameskill
chocolate-doom · Apr 23, 2024 · 2ea764f · 2ea764f
1 parent 7a1f38c
commit 2ea764f
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 2 deletions.
diff --git a/src/doom/p_mobj.c b/src/doom/p_mobj.c
@@ -804,7 +804,11 @@ void P_SpawnMapThing (mapthing_t* mthing)
     else if (gameskill == sk_nightmare)
 	bit = 4;
     else
-	bit = 1<<(gameskill-1);
+        // avoid undefined behavior (left shift by negative value and rhs too big)
+        // by accurately emulating what doom.exe did: reduce mod 32.
+        // For more details check:
+        // https://github.com/chocolate-doom/chocolate-doom/issues/1677
+        bit = (int) (1U << ((gameskill - 1) & 0x1F));
 
     if (!(mthing->options & bit) )
 	return;

diff --git a/src/strife/p_mobj.c b/src/strife/p_mobj.c
@@ -952,7 +952,11 @@ void P_SpawnMapThing (mapthing_t* mthing)
     else if (gameskill == sk_nightmare)
         bit = 4;
     else
-        bit = 1<<(gameskill-1);
+        // avoid undefined behavior (left shift by negative value and rhs too big)
+        // by accurately emulating what doom.exe did: reduce mod 32.
+        // For more details check:
+        // https://github.com/chocolate-doom/chocolate-doom/issues/1677
+        bit = (int) (1U << ((gameskill - 1) & 0x1F));
 
     if (!(mthing->options & bit) )
         return;