mirror/OpenMW
1
0
Fork 0
mirror of https://gitlab.com/OpenMW/openmw.git synced 2025-03-30 16:20:21 +00:00
Code Issues Projects Releases Wiki Activity

Fix a read head-buffer-overflow in esm

Browse Source 
The check forgot to account for the terminal zero.
This commit is contained in:
jvoisin 2021-04-16 21:03:58 +02:00
parent 57b501ad13
commit a35eae3dd1
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
components/esm/loadscpt.cpp
View File

@ -41,7 +41,7 @@ namespace ESM
// Support '\r' terminated strings like vanilla. See Bug #1324. // Support '\r' terminated strings like vanilla. See Bug #1324.
std::replace(tmp.begin(), tmp.end(), '\r', '\0'); std::replace(tmp.begin(), tmp.end(), '\r', '\0');
// Avoid heap corruption // Avoid heap corruption
if (!tmp.empty() && tmp[tmp.size()-1] != '\0') if (tmp.back() != '\0')
{ {
tmp.emplace_back('\0'); tmp.emplace_back('\0');
std::stringstream ss; std::stringstream ss;
@ -54,11 +54,12 @@ namespace ESM
str = tmp.data(); str = tmp.data();
} }
const auto tmpEnd = tmp.data() + tmp.size();
for (size_t i = 0; i < mVarNames.size(); i++) for (size_t i = 0; i < mVarNames.size(); i++)
{ {
mVarNames[i] = std::string(str); mVarNames[i] = std::string(str);
str += mVarNames[i].size() + 1; str += mVarNames[i].size() + 1;
if (static_cast<size_t>(str - tmp.data()) > tmp.size()) if (str >= tmpEnd)
{ {
// SCVR subrecord is unused and variable names are determined // SCVR subrecord is unused and variable names are determined
// from the script source, so an overflow is not fatal. // from the script source, so an overflow is not fatal.